Comment by gruez
18 hours ago
>They fail to mention that is has unfettered read access to your files.
Isn't that totally expected of a coding agent? Otherwise it's like complaining dropbox "has unfettered access to your files".
18 hours ago
>They fail to mention that is has unfettered read access to your files.
Isn't that totally expected of a coding agent? Otherwise it's like complaining dropbox "has unfettered access to your files".
Yes, but the answer is an indirection.
“How does Kimi Work protect my privacy when accessing local files?”
It doesn’t protect your privacy. It’s like asking, “how do I know you’re not spying on me?” And getting the reply “we cannot physically enter your house.”
>It doesn’t protect your privacy. It’s like asking, “how do I know you’re not spying on me?” And getting the reply “we cannot physically enter your house.”
In light of the recent grok build snafu, "Nothing happens without your consent" seems like an upgrade. Moreover what are they supposed to do here? By that logic should any sort of non e2e email/storage provider not be able to put "How does [product] protect my privacy" in their faq?
Looking through their privacy policy, it looks like the bigger issue is that they are (or refuse to refute) training on your data/prompts. That's probably what people should be complaining about rather than complaining about how it "has unfettered access to your files", when that describes all coding harnesses.
Yes I’m saying a question answered deceptively should not be one of the four featured questions on your product page.
> Looking through their privacy policy, it looks like the bigger issue is that they are (or refuse to refute) training on your data/prompts.
You’re making my entire point. They’ve designed an ingestion engine that is not private by design. Any sort of privacy posturing is wrong.
"How does Kimi Work protect my privacy" can be interpreted in two ways. The first is "How does Kimi Work protect my privacy from Moonshot?" They did not answer this question. The second is "How does Kimi Work protect my privacy from other third parties?" They are answering this question by saying, we won't upload your files to some third party server without your consent.
It is, but I really think this project would be better as open source. They are already all-in on open for the most valuable part (the frontier model)! They might as well make the harness fully transparent so that questions about what's being accessed and transmitted can be avoided.
I personally wouldn't use any agentic harness from any company, American, Chinese, or otherwise, that is closed source. The Grok fiasco shows why.
The repo you’re working on, sure. But all files?
> The repo you’re working on, sure. But all files?
Yes, any tool, including any coding agent, has access to all files $USER has access to.
Sandbox it explicitly to give access to only the current directory - https://github.com/ashishb/amazing-sandbox
Sorry, I meant that’s not desirable behavior that the user might expect. I understand that coding agent tools tend to play fast and loose with access because it’s not their own privacy/security at stake.
1 reply →
Not sure what that's about, I was just copying the wording from OP. Their harness probably has the same restrictions as most other coding harnesses. That is, the read tool gives all project files by default without prompting, and everything else requires manual approval (or opting into auto-run all). If you decide to run it from your home directory however, then your "project" is all your files.