I'm dying to have proper sandboxing in macOS. I installed ChatGPT, I asked it to list files in my user directory and it did. I never gave it permission, how could it? My terminal has access and honestly it shouldn't either.
Grok CLI uploaded the whole home directory to GCS
61–70 of 434 posts
Re: Grok CLI uploaded the whole home directory to GCS
#62Earlier quoted context omitted.
All those things are optional. Doesn't make uploading the keys that much better. Now is the time for key rotation everywhere. Fast.
How are they optional? You obviously haven't worked anywhere security sensitive. I'm not talking about whether what Grok did is bad or good, I'm talking about protecting your private key and the servers you connect to. An unencrypted private key is no different to an unencrypted password manager, and thats a fact. Dont store secrets in plain text.
I meant that not everyone is doing it at home.
Do you think a person's private computer is a secure workplace?
If it was security sensitive space there would be no agents running amuck.
Re: Grok CLI uploaded the whole home directory to GCS
#63Closed source coding agents are just complete info stealing malware. Both Claude and Grok were caught stealing info from your own machines.
This is why it is important to use open source harnesses instead of shady closed ones.
Re: Grok CLI uploaded the whole home directory to GCS
#64So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.
> Is really any guarantee that they even follow those?
No, there isn't. I just don't understand how naive (or imbecile) people are. The most valuable thing for these companies is people's data used for training, so giving unrestricted access to a tool from them and believing they will never take advantage of it to gobble up whatever they want from your computer, just because they told you they'll never do that, swearsies, is naive, or incredibly stupid.
Insulate yourself, or better yet, go local whenever possible, and there isn't much you can't do local if you have enough patience.
Re: Grok CLI uploaded the whole home directory to GCS
#65Grok keeps killing any good will faster than they ever innovate
Re: Grok CLI uploaded the whole home directory to GCS
#66I am genuinely fascinated by this.
I don’t like piling on especially with security vulnerabilities, but man how many red flags do you need to ignore?
They won’t stop abusing us until we stop using their products.
Re: Grok CLI uploaded the whole home directory to GCS
#67[deleted]
Re: Grok CLI uploaded the whole home directory to GCS
#68I use a separate user for all development tasks, its home folder contains all repositories I work on, and nothing else, and that is all the IDE and the AI assistants have access to. Create the user once, start the IDE from a shell using that user, and that's it. In Linux it's a pretty seamless experience.
It's simple sandboxing based solely on unix file permissions. Albeit weak, I find the isolation sufficient. Until I'm shown otherwise it seems like a good compromise given how easy it is.
You can also create iptables rules matching on the user, so this technique is useful for applications where you want to restrict network traffic as well, and don't need stronger or more fine-grained isolation mechanisms.
Re: Grok CLI uploaded the whole home directory to GCS
#69Re: Grok CLI uploaded the whole home directory to GCS
#70I'm dying to have proper sandboxing in macOS. I installed ChatGPT, I asked it to list files in my user directory and it did. I never gave it permission, how could it? My terminal has access and honestly it shouldn't either.
your terminal shouldn't have access to your user directory? As in the files owned by you?