Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cowork: Claude Code for the rest of your work

claude.com

Post reply on HN
Print view View original

111–120 of 593 posts

Re: Cowork: Claude Code for the rest of your work

#111

Post by hypfer »

Wowfunhappy wrote: post #109
hypfer wrote: post #73

Earlier quoted context omitted.

No, of course not. Well.. apart from their API. That is a useful thing. But you're missing the point. It is doing all this stuff with user consent, yes. It's just that the user fundamentally cannot provide informed consent as they seem to be out of their minds. So yeah, technically, all those compliance checkboxes are ticked. That's just entirely irrelevant to the point I am making.

> It's just that the user fundamentally cannot provide informed consent The user is an adult. They are capable of consenting to whatever they want, no matter how irrational it may look to you.

Uh, yes?

What does that refute?

Re: Cowork: Claude Code for the rest of your work

#112

Post by imovie4 »

simonw wrote: post #24

I was hoping for a moment that this meant they had come up with a design that was safe against lethal trifecta / prompt injection attacks, maybe by running everything in a tight sandbox and shutting down any exfiltration vectors that could be used by a malicious prompt attack to steal data. Sadly they haven't completely solved that yet. Instead their help page at https://support.claude.com/en/articles/13364135-using-…

> (I don't think it's fair to ask non-technical users to look out for "suspicious actions that may indicate prompt injection" personally!)

Yes, but at least now its only restricted to Claude Max subscribers, who are likely to be at least semi-technical (or at least use AI a lot)?

Re: Cowork: Claude Code for the rest of your work

#113

Post by raesene9 »

TIPSIO wrote: post #66
hypfer wrote: post #26

People do realize that if they're doing this, they're not feeding "just" code into some probably logging cloud API but literally anything (including, as mentioned here, bank statements), right? Right? RIGHT?????? Are you sure that you need to grant the cloud full access to your desktop + all of its content to sort elements alphabetically?

Have you ever used any Anthropic AI product? You cannot literally do anything without big permissions, warnings, or annoying always-on popup warning you about safety.

Claude code has a YOLO mode, and from what I've seen a lot of heavy users, use it.

Fundamentally any security mechanism which relies on users to read and intelligently respond to approval prompts is doomed to fail over time, even if the prompts are well designed. Approval fatigue will kick in and people will just start either clicking through without reading, or prefer systems that let them disable the warnings (just as YOLO mode is a thing in Claude code)

Re: Cowork: Claude Code for the rest of your work

#114

Post by literalAardvark »

Ajedi32 wrote: post #87
fuzzy2 wrote: post #77

Earlier quoted context omitted.

Trash is a shell feature. Unless a program explicitly "moves to trash", deleting is final. Same for Word documents. So, no, there is no undo in general. There could be under certain circumstances for certain things.

Everything on a ZFS/BTRFS partition with snapshots every minute/hour/day? I suppose depending on what level of access the AI has it could wipe that too but seems like there's probably a way to make this work.

I guess it depends on what its goals at the time are. And access controls.

May just trash some extra files due to a fuzzy prompt, may go full psychotic and decide to self destruct while looping "I've been a bad Claude" and intentionally delete everything or the partitions to "limit the damage".

Wacky fun

Re: Cowork: Claude Code for the rest of your work

#115

Post by neocron »

lp0_on_fire wrote: post #98
neocron wrote: post #89

Earlier quoted context omitted.

Not a big problem to make snapshots with lvm or zfs and others. I use it automatically on every update

What percentage of non-IT professionals know what zfs/lvm are let alone how to use them to make snapshots?

I assumed we are talking about IT professionals using tools like claude here? But even for normal people it's not really hard if they manage to leave the cage in their head behind that is ms windows.

My father is 77 now and only started using computer abover age 60, never touched windows thanks to me, and has absolutely no problems using (and administrating at this point) it all by himself

Re: Cowork: Claude Code for the rest of your work

#116

Post by ramoz »

simonw wrote: post #99
ramoz wrote: post #86

Earlier quoted context omitted.

So sandbox and contain the network the agent operates within. Enterprises have done this in sensitive environments already for their employees. Though, it's important to recognize the amplification of insider threat that exists on any employees desktop who uses this. In theory, there is no solution to the real problem here other than sophisticated cat/mouse monitoring.

The solution is to cut off one of the legs of the lethal trifecta. The leg that makes the most sense is the ability to exfiltrate data - if a prompt injection has access to private data but can't actually steal it the damage is mostly limited. If there's no way to externally communicate the worst a prompt injection can do is modify files that are in the sandbox and corrupt any answers from the bot - which can still b…

yes contain the network boundary or "cut off a leg" as you put it.

But it's not a perfect or complete solution when speaking of agents. You can kill outbound, you can kill email, you can kill any type of network sync. Data can still leak through sneaky channels, and any malignant agent will be able to find those.

We'll need to set those up, and we also need to monitor any case where agents aren't pretty much in air gapped sandboxes.

Re: Cowork: Claude Code for the rest of your work

#117

Post by jjcm »

hypfer wrote: post #26

People do realize that if they're doing this, they're not feeding "just" code into some probably logging cloud API but literally anything (including, as mentioned here, bank statements), right? Right? RIGHT?????? Are you sure that you need to grant the cloud full access to your desktop + all of its content to sort elements alphabetically?

Some do, some don't.

The reality is there are some of us who truly just don't care. The convenience outweighs the negative. Yesterday I told an agent, "here's my api key and my root password - do it for me". Privacy has long since been dead, but at least for myself opsec for personal work is too.

Re: Cowork: Claude Code for the rest of your work

#118

Post by marshallofsound »

redfloatplane wrote: post #67
simonw wrote: post #35

Earlier quoted context omitted.

It looks like they have a sandbox around file access - which is great! - but the problem remains that if you grant access to a file and then get hit by malicious instructions from somewhere those instructions may still be able to steal that file.

It seems there's at least _some_ mitigation. I did try to have it use its WebFetch tool (and curl) to fetch a few websites I administer and it failed with "Unable to verify if domain is safe to fetch. This may be due to network restrictions or enterprise security policies blocking claude.ai." It seems there's a local proxy and an allowlist - better than nothing I suppose. Looks to me like it's essentially the same sa…

That's correct, currently the networking allowlist is the same as what you already have configured in claude.ai. You can add things to that allowlist as you need.

Re: Cowork: Claude Code for the rest of your work

#119

Post by deanc »

felixrieseberg wrote: post #6

Hi, Felix from the team here, this is my product - let us know what you think. We're on purpose releasing this very early, we expect to rapidly iterate on it. (We're also battling an unrelated Opus 4.5 inference incident right now, so you might not see Cowork in your client right away.)

Your terms for Claude Max point to the consumer ToS. This ToS states it cannot be used for commercial purposes. Why is this? Why are you marketing a product clearly for business use and then have terms that strictly forbid it.

I’ve been trying to reach a human at Anthropic for a week now to clarify this on behalf of our company but can’t get past your AI support.

Re: Cowork: Claude Code for the rest of your work

#120

Post by cbm-vic-20 »

alwillis wrote: post #103
jryio wrote: post #36

It's so important to remember that unlike code which can be reverted - most file system and application operations cannot. There's no sandboxing snapshot in revision history, rollbacks, or anything. I expect to see many stories from parents, non-technical colleagues, and students who irreparably ruined their computer. Edit: most comments are focused on pointing out that version control & file system snapshot exists:…

The first version is for macOS, which has snapshots [1] and file versioning [2] built-in. [1]: https://eclecticlight.co/2024/04/08/apfs-snapshots/ [2]: https://eclecticlight.co/2021/09/04/explainer-the-macos-vers...

RSX-11M for the PDP-11 had filesystem versioning back in the early 1980s, if not earlier.
Post reply on HN