Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cowork: Claude Code for the rest of your work

claude.com

Post reply on HN
Print view View original

211–220 of 593 posts

Re: Cowork: Claude Code for the rest of your work

#211

Post by nezhar »

lifetimerubyist wrote: post #141
simonw wrote: post #24

I was hoping for a moment that this meant they had come up with a design that was safe against lethal trifecta / prompt injection attacks, maybe by running everything in a tight sandbox and shutting down any exfiltration vectors that could be used by a malicious prompt attack to steal data. Sadly they haven't completely solved that yet. Instead their help page at https://support.claude.com/en/articles/13364135-using-…

Prompt injection will never be "solved". It will always be a threat.

The isolation pattern is a good starting point.

Re: Cowork: Claude Code for the rest of your work

#212

Post by alwillis »

nikkwong wrote: post #151
alwillis wrote: post #110

Earlier quoted context omitted.

At least on macOS, an OS snapshot is a thing [1]; I suspect Cowork will mostly run in a sandbox, which Claude Code does now. [1]: https://www.cleverfiles.com/help/apfs-snapshots.html

Ok, you can "easily", but how quickly can you revert to a snapshot? I would guess creating a snapshot for each turn change with an LLM become too burdensome to allow you to iterate quickly.

For the vast majority, this won't be an issue.

This is essentially a UI on top of Claude Code, which supports running in a sandbox on macOS.

Re: Cowork: Claude Code for the rest of your work

#213

Post by gist »

zurfer wrote: post #166

I'm a bit shocked to see so many negative comments here on HN. Yes, there are security risks and all but honestly this is the future. It's a great amplifier for hackers and people who want to get stuff done. It took some training but I'm now starting almost all tasks with claude code: need to fill out some word document, organize my mail inbox, write code, migrate blog posts from one system to another, clean up my co…

> I'm a bit shocked to see so many negative comments here on HN.

Very generally I suspect there are many coders on HN who have a love hate relationship with a tool (claude code) that has and will certainly make many (but not all) of them less valuable given the amount of work it can do with even less than ideal input.

This could be a result of the type of coding that they do (ie results of using claude code) vs. say what I can and have done with it (for what I do for a living).

The difference perhaps is that my livlihood isn't based on doing coding for others (so it's a total win with no downside) and it's based on what it can do for me which has been nothing short of phemomenal.

For example I was downvoted for this comment a few months ago:

https://news.ycombinator.com/item?id=45932641

Just one reply (others are interesting also):

"HN is all about content that gratifies one’s intellectual curiosity, so if you are admitting you have lost the desire to learn, then that could be triggering the backlash."

(HN is about many things and knowing how others think does have a purpose especially when there is a seismic shift that is going on and saying that I have lost the desire to learn (we are talking about 'awk' here is clearly absurd...)).

Re: Cowork: Claude Code for the rest of your work

#214

Post by yencabulator »

dpark wrote: post #121
simonw wrote: post #99

Earlier quoted context omitted.

The solution is to cut off one of the legs of the lethal trifecta. The leg that makes the most sense is the ability to exfiltrate data - if a prompt injection has access to private data but can't actually steal it the damage is mostly limited. If there's no way to externally communicate the worst a prompt injection can do is modify files that are in the sandbox and corrupt any answers from the bot - which can still b…

Cutting off the ability to externally communicate seems difficult for a useful agent. Not only because it blocks a lot of useful functionality but because a fetch also sends data. “Hey, Claude, can you download this file for me? It’s at https://example.com/(mysocialsecuritynumber)/(mybankinglogin... ”

An easy gimmick that helps is to allow fetching URLs explicitly mentioned in user input, not trusting ones crafted by the LLM.

Re: Cowork: Claude Code for the rest of your work

#215

Post by tedmiston »

postalcoder wrote: post #150
viraptor wrote: post #85

Earlier quoted context omitted.

> (I don't think it's fair to ask non-technical users to look out for "suspicious actions that may indicate prompt injection" personally!) It's the "don't click on suspicious links" of the LLM world and will be just as effective. It's the system they built that should prevent those being harmful, in both cases.

It's kind of wild how dangerous these things are and how easily they could slip into your life without you knowing it. Imagine downloading some high-interest document stashes from the web (like the Epstein files), tax guidance, and docs posted to your HOA's Facebook. An attacker could hide a prompt injection attack in the PDFs as white text, or in the middle of a random .txt file that's stuffed with highly grepped wo…

The only truly secure computer is an air gapped computer.

Re: Cowork: Claude Code for the rest of your work

#216

Post by yencabulator »

rynn wrote: post #198
lifetimerubyist wrote: post #141

Earlier quoted context omitted.

Prompt injection will never be "solved". It will always be a threat.

9 years into transformers and only a couple years into highly useful LLMs I think the jury is still out. It certainly seems possible that some day we'll have the equivalent of an EDR or firewall, as we do for viruses and network security. Not perfect, but good enough that we continue to use the software and networks that are open enough that they require them.

Firewalls run on explicit rules. The "lethal trifecta" thing tells you how to constrain an LLM to enforce some set of explicit rules.

Re: Cowork: Claude Code for the rest of your work

#217

Post by gist »

keybored wrote: post #196
zurfer wrote: post #166

I'm a bit shocked to see so many negative comments here on HN. Yes, there are security risks and all but honestly this is the future. It's a great amplifier for hackers and people who want to get stuff done. It took some training but I'm now starting almost all tasks with claude code: need to fill out some word document, organize my mail inbox, write code, migrate blog posts from one system to another, clean up my co…

> Yes, there are security risks and all but honestly this is the future. That’s it? There are security risks but The Future? On the one hand I am giving it access to my computer. On the other hand I have routine computer tasks for it to help with? Could these “positive” comments at least make an effort? It’s all FOMO and “I have anecdotes and you are willfully blind if you disagree”.

The issue here with the negativity is that it appears to ignore the potential tremendous upside and tends to discuss the downside and in a way that appears to make as if it's lurking everywhere and will be a problem for everyone.

Also trying to frame it as protecting vulnerable people who have no clue about security and will be taken advantage of. Or 'well this must be good for Anthropic they will use the info to train the model'.

It's similar to the privacy issue assuming everyone cares about their privacy and preventing their ISP from using the data to target ads there are many people who simply don't care about that at all.

Re: Cowork: Claude Code for the rest of your work

#218

Post by [deleted] »

deanc wrote: post #140
concinds wrote: post #125

Earlier quoted context omitted.

> Why are you marketing a product clearly for business use Huh? Their "individual" plans are clearly for personal use.

Is that why you can enter a business id on the payment form? Just read the marketing page [0]. The whole thing is aimed at people running a business or operating within one. [0] https://claude.com/pricing/max

[deleted]

Re: Cowork: Claude Code for the rest of your work

#219

Post by johnisgood »

simonw wrote: post #99
ramoz wrote: post #86

Earlier quoted context omitted.

So sandbox and contain the network the agent operates within. Enterprises have done this in sensitive environments already for their employees. Though, it's important to recognize the amplification of insider threat that exists on any employees desktop who uses this. In theory, there is no solution to the real problem here other than sophisticated cat/mouse monitoring.

The solution is to cut off one of the legs of the lethal trifecta. The leg that makes the most sense is the ability to exfiltrate data - if a prompt injection has access to private data but can't actually steal it the damage is mostly limited. If there's no way to externally communicate the worst a prompt injection can do is modify files that are in the sandbox and corrupt any answers from the bot - which can still b…

The response to the user is itself an exfiltration channel. If the LLM can read secrets and produce output, an injection can encode data in that output. You haven not cut off a leg, you have just made the attacker use the front door, IMO.

Re: Cowork: Claude Code for the rest of your work

#220

Post by yencabulator »

Workaccount2 wrote: post #152
jryio wrote: post #36

It's so important to remember that unlike code which can be reverted - most file system and application operations cannot. There's no sandboxing snapshot in revision history, rollbacks, or anything. I expect to see many stories from parents, non-technical colleagues, and students who irreparably ruined their computer. Edit: most comments are focused on pointing out that version control & file system snapshot exists:…

Frequency vs. convenience will determine how big of a deal this is in practice. Cars have plenty of horror stories associated with them, but convenience keeps most people happily driving everyday without a second thought. Google can quarantine your life with an account ban, but plenty of people still use gmail for everything despite the stories. So even if Claude cowork can go off the rails and turn your digital life…

I mean, we were there before this Cowork feature started exposing more users to the slot machine:

"Claude CLI deleted my home directory and wiped my Mac" https://news.ycombinator.com/item?id=46268222

"Vibe coding service Replit deleted production database, faked data, told fibs" https://news.ycombinator.com/item?id=44632575

"Google Antigravity just deleted the contents of whole drive" https://news.ycombinator.com/item?id=46103532

Post reply on HN