Running Claude Code dangerously (safely)

Post by andai » Tue, Jan 20, 2026, 4:10 PM UTC

snowmobile wrote: post #121

Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on con…

Post by devolving-dev » Tue, Jan 20, 2026, 4:17 PM UTC

johndough wrote: post #136

devolving-dev wrote: post #127

Earlier quoted context omitted.

Don't you have the same issue when you hire an employee and give them access to your systems? If the AI seems capable of avoiding harm and motivated to avoid harm, then the risk of giving it access is probably not greater than the expected benefit. Employees are also trying to maximize paperclips in a sense, they want to make as much money as possible. So in that sense it seems that AI is actually more aligned with m…

I do not believe that LLMs fear punishment like human employees do.

Post by giancarlostoro » Tue, Jan 20, 2026, 4:23 PM UTC

icedchai wrote: post #128

giancarlostoro wrote: post #97

Earlier quoted context omitted.

This could be avoided by aliasing rm to something else that stops you from deleting stupid things like your entire home directory / partition root.

What if the LLM detects this, and chooses to run /bin/rm directly? Or worse, writes a program that calls unlink.

Post by 0xbadcafebee » Tue, Jan 20, 2026, 4:27 PM UTC

  > So now you need Docker-in-Docker, which means --privileged mode, which defeats the entire purpose of sandboxing.
  > That means trading “Claude might mess up my filesystem” for “Claude has root-level access to my container runtime.”

  # Build 'claude' VM and Docker context
  
  $ colima start --profile claude --vm-type=qemu
  $ docker context create claude --docker "host=unix://$HOME/.colima/claude/docker.sock"
  $ docker context use claude
  
  # Start DinD, pass through ports 8080 and 8443, and mount one host directory (for a Git repo)
  
  $ docker run -d --name dind-lab --privileged -e DOCKER_TLS_CERTDIR= -v dind-lab-data:/var/lib/docker \
    -p 8080:8080 -p 8443:8443 -v /home/MYUSER/GITDIR:/mnt/host/home/MYUSER/GITDIR \
    docker:27-dind
  $ docker run --rm -it -e DOCKER_HOST=tcp://127.0.0.1:2375 \
    -p 8080:8080 -p 8443:8443 -v /mnt/host/home/MYUSER/GITDIR:/home/MYUSER/GITDIR \
    ubuntu:24.04 bash

  # Or if you don't want to pass-through ports w/ DinD twice, use its network namespace directly
  #  ( docker run --rm -it -e DOCKER_HOST=tcp://127.0.0.1:2375 --network container:dind-lab .... )

Post by redactsureAI » Tue, Jan 20, 2026, 4:34 PM UTC

lucasluitjes wrote: post #118

> What you’re NOT protecting against: > a malicious AI trying to escape the VM (VM escape vulnerabilities exist, but they’re rare and require deliberate exploitation) No VM escape vulns necessary. A malicious AI could just add arbitrary code to your Vagrantfile and get host access the first time you run a vagrant command. If you're only worried about mistakes, Claude could decide to fix/improve something by adding a…