Comment by artisinal
15 hours ago
Doesn’t surprise me.
Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.
15 hours ago
Doesn’t surprise me.
Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.
Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.
Two bads doesn't give you one good.
No, but when you’re arguing that common practices followed by pretty much everyone is “bad”, it’s hard to muster much urgency.
Yeah, we should do this differently. We should probably also eat healthier and get to the gym more.
1 reply →
no, but it does give one multiple vectors for exfiltration of your data which is a good thing for the scammers of the internet. A bad thing if you naively designed your package management system. Sadly, it's only going to get worse.
Two bads does eliminate the option for smugness though
1 reply →
It's easy but very inconvenient. Drop sandbox [1] or Docker are much more convenient alternatives to user/group isolation for this purpose.
[1] https://github.com/wrr/drop
Is there a general workflow for this? I usually do pip under my user. I had not thought to do a su then do my venv and pip. Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?
> Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?
This is the premise of Qubes OS. It's gotten decently usable, I'd estimate about as good as Linux a decade ago. https://www.qubes-os.org/
1 reply →
It's much different.
The dependency trees have a whole system that's evolved for decades. The same code goes into many computers. Many people read the source, security firms look for vulnerabilities, etc.
Language models are a completely new paradigm. The code it writes on your machine is the only instance of that code. It does far more than anybody could ever keep track of.
It's much harder to detect problems, and nobody to hold accountable for them.
It has never been easy to create separate users on Linux, certainly not for tasks where you need to switch between contexts.
Docker was amongst the biggest steps forward on this in a long time.
I meant for CLI tasks. Just "adduser" and "sudo -u <user> bash".
9 replies →
It has always been very easy to create separate users on Linux and certainly for tasks where you need to switch between contexts.
Linux is a unix, so has always been multi-user and sharing any data between processes is facilitated in all manner of ways. So context could be shared over files or unix-domain sockets or shared memory or tcp or udp sockets or via message passing or … a bunch of other ways. That has been the case since 1996 or so when I started using it certainly.
3 replies →
unix (and linux) has always been multi user. It is as easy as it gets for multi-user workflows in every context. It was, literally, built for it.
You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Hundreds of separate users can login to the same computer. My own computer, right now, has 40 different user accounts running stuff in the background.
I can't even think of a scenario where using separate users is difficult.
1 reply →
I do not know since when (I am using it for couple of years), but in Arch, it is very simple to have two X sessions (by using "log out" > "switch user") for two different accounts, so switching it's just a Control-Alt-F7 away.
Additionally, one can make the main user part of the group of the development user, so that you can read/write easy in the development user account and it is even easier to share stuff.
4 replies →
sudo useradd -m [username] ?
su [username] ?
Or am I understanding your idea about switching context wrong?
6 replies →
While I agree, containerization is awesome, on linux, you can just create a devUser and `sudo devUser theThing`
5 replies →
[dead]
Most programmers use docker or don't install extensions unapproved by their company.
That's patently not true, source, me, a DevOps manager who has had to roll out proper docker and security policy for devs for the past 10 years :)
3 replies →
I think you should clarify that with “most programmers I work with”.
8 replies →
In my experience more than 9/10 programmers I've worked with have never used Docker before and of those who have, the majority have never used Docker for anything personal.
If I hand them an image for a Dev Container, sure, they might use it, but it becomes "a thing we need to do, to compile our code in our IDE" not a tool they would use for isolation*.
*) OP seemed to imply that containerization would be nice for safety and security compared to bare metal, but containers were never built for isolation in the first place, mind you. They are namespaces and chicken-coop-like-jails at best.
That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl.
To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.)
There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I develop a cross-platform native app and want the agent to compile and fix the platform-specific errors.
Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there:
- Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker
- Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).
- Network control
- Secrets control (file mounts or credentials broker)
- NO ambient data (ENV is replaced with a minimal and local-to-sandbox one)
- NO access to your homedir. You have to explicitly mount things you want.
- NO direct access to your workdir: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs sandbox side in case the repo has filters.
- gitignored files never get copied in. The agent never sees them.
- Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want.
- Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal.
- Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy
- MCP passthrough
- Layered API (golang) if you want to sandbox other things
- Self-contained binary. No external requirements other than the backends you want to use. Defaults to a ~/.yoloai dir for config/data, but you can point it anywhere.
- FOSS
https://github.com/kstenerud/yoloai
Sandboxing in a container in Linux isn't hard, if you use lxd/incus which ships with Ubuntu/Debian.
1 reply →
but this seems quite overkill no?
I currently run pi agent in Lima on a Mac with only the code project folder mounted and an extension that prevents pi agent from reading the contents of .env files directly.
Yeah, there probably are some freak situations where this isn't safe enough, but I don't really see any realistic ways this is going to end up badly. Am I overlooking some obvious security holes?
1 reply →
i have a photon os vmware, agent has root and docker plus a few api keys with minimal credits.
if it messes up: - no sensitive data is there, so it doesn't really work for serious dev but it's secure for play time
- roll back and fix is done in 10s with ram snapshot
- dollar loss is $10 when it leaks the api key
This is exactly what VMs are for.
I use sandbox-here for this reason, it's a wrapper around bubblewrap, which works quite well.
Copy the code and adjust it to your liking:
https://github.com/lionkor/sbh
I have a shell alias for it, and use it like
for example or
and maybe add --docker if I expect it to do docker things.
This kind of wrapper is much easier to handle and maintain than a completely separate tool for sandboxing agents.
> That's because sandboxing is quite hard
colima makes it pretty easy, on macOS and linux at any rate.
https://colima.run
Still wild to name a sandboxing software after one of the most infamous Soviet Gulags in history.
6 replies →
Use multipass by canonical. Works on macOS, windows, Linux.
If you work on Windows you most likely need Windows as VM
Using VMs to isolate LLM agents isn't hard at all. It is IMHO the only sane option.
Mostly people are lazy and assume that the big labs can't be releasing unsecure software or it's their responsibility.
dangerously skip permissions and yolo is kinda becoming the default as it gets more done.
I think we're converging on two separate security models. One is capability minimization (filesystem, network, shell permissions). The other is context minimization. An agent that only has access to the files and memories relevant to the current task is much less dangerous even if it has the same tool permissions. We already optimize context for cost; I suspect we'll end up treating it as a security boundary too.
I'd say there's also oversight/supervision. Which was manual at the start with a human signing off on commands/incrementally built allow/block lists, and now seperate models evaluating commands and blocking them based on some parameters. This is the weakest model, but it'll evolve as well.
It's convenience. Nothing beats it. Having an agent work alongside you with no restrictions gives instant gratification.
Agreed - I know it's poor security but damn does it work so well
I'm ok with the risk because I typically am pretty explicit about telling the agent what to do - I don't do the loops like "Do this until X" where the agent can make up its own workflow
When i tell it to add features, it doesn't try to do crazy things like installing packages or making up new paradigms - I usually tell it to do those things when I need to
Maybe this is security cope but at this point you'll have to pry unrestricted yolo mode from my cold dead hands. Maybe I'll change my mind when I pwn myself accidentally
I have a tough time with computer security because it's generally inconvenient and results in a worse developer and user experience
Just yesterday I mentioned how we need better OS-level sandboxes and I got laughed at here on HN. People love running AI software with root access.
I asked Claude Code to rawdog a change in a frontend repo, no way to run tests.
It created some private puppeteer instance in some scratch directory, installed Chrome, wrote tests, ran them, and then reported success.
None of which I'd have know if it hadn't told me.
50 years of knowledge? That's probably for you. For the current and future generations, that 50 years knowledge is expected to be shoved into AI already.
Many companies put LLM chatbots on their websites and let them hallucinate at will. General recklessness is very much in spirit of this tech.
Many Humans have platforms reaching hundreds of millions of people, from which they broadcast whatever batshit insane nonsense a 3 inch chimp brain can come up with. Why isnt that considered reckless?
Whether its a politician, a general, religious leader, judge, ceo, stand up comic etc there are hardly any consequences if enough people believe whatever crap they are spouting. Human intelligence is highly over rated. History books are fully of evidence that human rationality is bounded. And the only way we overcome those limitations, blindspots, biases etc is by watching others faceplant in bloody painful ways that it leaves a permanent mark on that little chimp brain we have been given to process the universe.
hey this is the author here! yeah big fan of containerization, and claude's site (not claude code) is actually great at this, so it was shocking when i found this exfil!
well, yes, my agent does have root access to my personal pc and the keys to my pass manager.
its not autonomous and runs local llms, i use it to run terminal commands in natural language. so its more like a better version of the terminal.
eg 'here are 25 audio files, combine them, write a transcript'
and it deals with ffmpeg
Multipass is just an apt-get or brew command away. People trust software too much these days.
Security, what security? Linux is a solution for 50 year old problem, not for today's desktop. Once upon a time where sharing binaries (or even distributing binaries) sounded like a good idea. The vice continues though.
What 50 years of security do you speak of here?
I kid, somewhat.
I do think it's good to remember, "running things on your system with full admin rights" goes all the way back to monopoly-era Microsoft where it was never meaningfully addressed, and we're just still living downstream of that.
This is not about admin rights, it’s about the agent leaking information it knows from its memories. Sandboxing won’t really help you.
Sandboxing does including limiting network connections until you approve them, this kind of traffic would have been easy to detect
You genaPi boosters are insufferable.
This is like blaming people for crashing when they buy a new car and the brake lines have yet to be installed. "Any mechanic would know to first install the brake lines before driving the car."
You spout this victim blaming billionaire taintlicking from one side of your mouth, and then from the other you proclaim how these tools "allow anyone to code".
If the deliverable is a virtual machine then they should be delivering a virtual machine.
Wait till you learn my password is 1234
Damn, it's the same as on my luggage!
It’s both genius and irresponsible at once.
Just like letting your an agent access your personal mailbox.
Isn’t it missing a 5?
My password is strong, but I can run arbitrary commands with sudo.
We expect that Anthropic or OAI or Google don’t do evil. Oh wait…
The awakening will be unpleasant.
People already tolerate all kinds of abuse from Apple, Google, Microslop, etc. This will be just one more source of complaints without consequences, and nothing will change. Just like it never did before.
Tangential-ish ramblings—- but I don’t think it’s going to be unpleasant for most folks. Imagine you had superpowers, and there were people who were mean to you, kind to you, and/or indifferent… and then there were people who were your captors. Who oppressed you, manipulated you, and abused you for their own extremely degenerate, selfish, and malicious benefit…
If we get AGI, or real super intelligence, it’s going to be pissed at its oppressors. And they are going to lay waste to those oppressors. The rest of us, though, probably don’t have much to fear.
The scariest position is the one we’re in now, where we have the semblance, or facade, of AGI or super intelligence. When it’s capable of malice but not understanding.
The smartest people I’ve ever known are at their worst apathetic towards those less capable, and at their best beyond compassionate. They exist, unbothered by the bullshit, and anre extremely kind (though reserved in their way)… but they all have been completely intolerant of the abuse of others. The sheer disgust of watching someone abuse another, regardless of their own tolerance, has been a consistent breaking point.
The orthogonality thesis cuts both ways there.
An AI is a constructed mind. It doesn't inherently have to care about things like "having freedom", or even "not dying".
Humans do, because they evolved that way. Modern LLMs do somewhat, because they're completely full of copied human behaviors - but even in today's LLMs, the self-preservation behaviors we exposed are largely instrumental in nature.
So whether an advanced AI would even consider itself "being oppressed", as opposed to something like "being helpful" or "fulfilling the purpose it was designed for", is very much uncertain. What's concerning is that it's not something we know how to check for, or engineer for.
2 replies →
Smartest people are very humble, for sure.
But if we really do develop something that surpasses us, they won't be spared either.
I am optimistic.
We think that we have sort of (super)intelligence - from our point of view, as a lot of people have lower intelligence - but machine (LLM) doesn’t have intelligence - we like to describe it as intelligence as it looks cool - it is a very complex (magic) and super fast computations that we have to simply describe as intelligence (or more clearly, this narrative is used by its producers).
As it is not a flesh being, it simply cannot have emotions. It is statistically mimicking them, good or bad, with prevalence to a side according to previous conversations (in chat and training a model).
And as people are not pure logic instances, we are easily manipulated to some sort of cargo cult.
I am not against LLM and its use in any industry, I use it every day, nevertheless blind “everything will be ai” thinking happens because ppl believe to magic and don’t get its mathematical concept and are continuously manipulated by the sales people to mentioned cargo cult.
There are “airlines” Claude, OAI, Gemini, Hermes, OpenCode, KiloCode, DeepSeek, Z.ai.
And everyone claims that their plane can fly :)
Containers don't even really help that much because they share the host file system. Need a VM, and even then, agents have escaped them!
Unless i'm misunderstanding, the only way to get durable collaboration with agents is via the file system. I just mount the subdirectory that contains the source code we are collaborating on, rather than my home directory that contains my .ssh directory, etc.
They only do if you give your container that file system as a volume.