Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on contagious bacteria in your backyard, not really something your neighbors would appreciate.
Running Claude Code dangerously (safely)
121–130 of 265 posts
Re: Running Claude Code dangerously (safely)
#122For deploying Claude Code as agent, Cloudflare is also an interesting option. I needed a way to run Claude marketplace agents via Discord. Problem: agents can execute code, hit APIs, touch the filesystem—the dangerous stuff. Can't do that in a Worker's 30s timeout. Solution: Worker handles Discord protocol (signature verification, deferred response) and queues the task. Cloudflare Sandbox picks it up with a 15min tim…
This sounds handy! Have you published any code by any chance?
Not yet, but will do so soon at https://github.com/tenzir.
Re: Running Claude Code dangerously (safely)
#123I'm a fan of https://e2b.dev/
Re: Running Claude Code dangerously (safely)
#124I have been running two or three Claude’s bare metal with dangerously skip permissions all day every day for two months now. It’s absolutely liberating.
I have been driving without seat belt for two month now. It’s absolutely liberating.
I have been skydiving without a parachute for 23 seconds now. It's absolutely liberating.
Re: Running Claude Code dangerously (safely)
#125Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on con…
I run mine in a docker container and they get read only access to most things.
Re: Running Claude Code dangerously (safely)
#126I run Claude in a Proxmox VM, generally the experience has been great. In my experience it also behaves better than gemini cli, that likes to create files all over the place if set loose (lesson learned to add that requirement to the relevant .md files)
I too use this solution, using both Ubunutu LXCs and full-fledged VMs. Only issue I've struggled with has been losing SSH connection on the LXC, and tmux and session both seem to mess up the terminal formatting in CC.
I do agree with the security / cautionary comments and wouldn't leverage this setup outside a hacked together homelab.
Re: Running Claude Code dangerously (safely)
#127Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on con…
Don't you have the same issue when you hire an employee and give them access to your systems? If the AI seems capable of avoiding harm and motivated to avoid harm, then the risk of giving it access is probably not greater than the expected benefit. Employees are also trying to maximize paperclips in a sense, they want to make as much money as possible. So in that sense it seems that AI is actually more aligned with my goals than a potential employee.
Re: Running Claude Code dangerously (safely)
#128Earlier quoted context omitted.
Until it decides to delete your home directory: https://old.reddit.com/r/ClaudeAI/comments/1pgxckk/claude_cl...
This could be avoided by aliasing rm to something else that stops you from deleting stupid things like your entire home directory / partition root.
What if the LLM detects this, and chooses to run /bin/rm directly?
Or worse, writes a program that calls unlink.
Re: Running Claude Code dangerously (safely)
#129Earlier quoted context omitted.
I like the bubblewrap approach, it just happens to be Linux-only unfortunately. And once privileges are dropped for a process it doesn't appear to be possible to reinstate them.
> Linux-only What other dev OSs are there? > once privileges are dropped [...] it doesn't appear to be possible to reinstate them I don't understand. If unprivileged code could easily re-elevate itself, privilege dropping would be meaningless ... If you need to communicate with the outside, you can do so via sockets (such as the bind-mounted X11 socket in one of the readme Examples).
I happen to use a Mac, even when targeting Linux so I'd have to use a container or VM anyways. It's nice how lightweight bubblewrap would be however.
Consider one wanted to replicate the human-approval workflow that most agent harnesses offer. It's not obvious to me how that could be accomplished by dropping privileges without an escape hatch.
Re: Running Claude Code dangerously (safely)
#130> now you need Docker-in-Docker Or you can just mount the socket and call docker from within docker.
Correct, which I wanted to avoid because: > Mounting the Docker socket grants the agent full access to your Docker daemon, which has root-level privileges on your system. The agent can start or stop any container, access volumes, and potentially escape the sandbox. Only use this option when you fully trust the code the agent is working with. https://docs.docker.com/ai/sandboxes/advanced-config/#giving...
PM for Docker Sandboxes here.
We have an updated version of Sandboxes coming out soon that uses MicroVM isolation to solve this exact problem. This next version will let your agent access a Docker instance within the MicroVM, therefore allowing you to do this securely.