Comment by grey-area
1 day ago
Biggest questions here, which I think need answering:
Should Claude have access to user details? I’d say no, unless explicitly entered manually into a chat.
Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.
Should Claude have internet access without a clear log of all requests made?
Instances of Claude should be heavily sandboxed and kept away from user data, far more so than they are now. The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project.
This impression is not true, as evidenced by Claude pulling data from other sessions outside a project even when not instructed to (I’ve seen this a few times), and in this case pulling your email (from account details, user contacts? I wonder where it got that info?).
None of this information should be available to Claude, by design, not by instruction. Using text instructions to try to limit these machines is an incredibly flawed approach and should not be necessary for important info. Anthropic should have the model access completely locked down by controls at the os level over file access, not open by default. That is how to fix this.
If a user wants to open access that should be an explicit choice from them, with a warning about possible consequences.
> Should Claude have access to user details?
This is hard to avoid. All it needs to do is make a git commit and look in the git log and it will find out who you are.
At least we, as users, have control of what information Claude has access to in this case:
etc.
That's barely control. There's going to be 100 ways your email leaks.
2 replies →
Why does it need to perform a commit to read the log?
The repo's other commits could be from someone else - whereas a commit it wrote itself is guaranteed to be from the correct/local account.
2 replies →
I am developing a project to sandbox AI coding agents at very basic level: https://github.com/daitangio/take-ai-control
I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.
It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.
As always feedback is wellcomed
> I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.
Maybe use two containers in the same docker network. One docker container has the agent and is not allowed to leave the network. The other container you'd run a proxy in with whitelisting and that container is allowed to leave the network.
Why not use a microVM instead of a container ?
> Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.
This is definitely a question that sounds straightforward but isn't. Like, when I ask antigravity to commit to git, it gets an error because ~/.gitconfig is outside the sandbox.
Sure, it's a hard problem, that doesn't mean we shouldn't tackle it. It is in fact one of the more urgent problems for Anthropic to address properly.
I'd feel a lot safer granting fine grained permissions like that, than knowing that the only thing stopping the LLM reading files is that it hasn't thought to do so.
I mean, I think Claude has some controls on file access, but I'm not exactly sure any more what is and what isn't allowed. The impression their desktop app gives is that you need to give permission for each and every file or folder access, but I'd feel a lot safer if that were imposed by an operating system level constraint, not claude trying to read the use of tools and ok/disallow them based on what an llm thinks.
It seems very unlikely that "leaking email addresses" is anywhere near being "one of the more urgent problems for Anthropic". This is a company whose training models occasionally commit felonies, and whose IPO documents claim that they might potentially kill all of humanity.
1 reply →
I usually run claude sandboxed, but had to do something on Windows and didn't want to be bothered. Opened a project, asked something generic about it and in the first response Claue tells me it tried to fetch all URLs it found it in it and what errors were in responses. Cool stuff.
Yes, they need to be heavily sandboxed. On my machine, LLMs are constrained to docker containers for me, no exceptions.
Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).
The models are very aggressive in finding the info they need. I had one find some API key somewhere so that it can make requests. Sloppy on my part of having API keys not related on the hard drive but was not expecting the model to burn my harddrive in a lookup for api keys.
No question needs answering. If you want to run claude code inside sandboxed environment, it's not that hard and there are lot of options including official[0].
[0]: https://code.claude.com/docs/en/sandboxing
From the doc, this suggestion is hardly satisfactory:
The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.
Also this is in my view the main job of a scaffold like claude code - to restrict what the agent can see and make sure it doesn't use info it should not. It's not something a user can easily or should have to attempt to control themselves.
File tools, by default asks permission to edit outside directory. There is no MCP tools or hooks by default and if you install it you need explicit permission to trust it.
These CLI sandboxes are trash, use something else. Container, VM, not your computer. Just don't run it on your bare system, please.