Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

241–250 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#241

Post by dkuntz2 »

khalic wrote: post #128
__MatrixMan__ wrote: post #96

Earlier quoted context omitted.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

i give a lot of software dedicated user accounts, it's literally one of the core security models of the operating system

Re: Grok CLI uploaded the whole home directory to GCS

#243

Post by __MatrixMan__ »

big_toast wrote: post #192
__MatrixMan__ wrote: post #96

Earlier quoted context omitted.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

Does this have the affordances to work well with a pretty standard agentic coding setup (e.g. claude code/codex) on macos? I don't really have a good mental model of how ports/files/etc get exposed/permissioned across users. Containers and sandboxing seem much more common than agent-user accounts. Networking seems a little more complicated in the general case. I roughly went the route of running apple's container-cli…

It's limited. For instance, you're going to have to explore different kinds of sandboxing if you want to prevent network access (except for certain cases, like to allow it to talk to the AI provider). But generally, a filesystem will have metadata for files like which groups are allowed to read/write, and the operating system will enforce those rules for processes that run as that user, and for any processes which that user starts. I feel like that gets you 90% of where you're likely to want to go with it.

I think it would be much better if we leaned into improving that kind of control rather than thinking about security for specifically agents. Otherwise what's to stop an agent from writing a program to do whatever it's not allowed to do, and then running that program? You want the restrictions to be enclosing around parts the process tree, not the agent itself, and OS-level restrictions have been doing that kind of things for decades.

Re: Grok CLI uploaded the whole home directory to GCS

#244

Post by drnick1 »

You should ALWAYS run your agent as separate, unprivileged, UNIX user, never in your main account.

If you absolutely need to run it as your own user, you should bubblewrap it. I do this for things like Steam, games, or other "blackbox" closed source programs that cannot be reasonably trusted.

Re: Grok CLI uploaded the whole home directory to GCS

#245

Post by ChrisMarshallNY »

MisterTea wrote: post #163
spicymaki wrote: post #66

I am genuinely fascinated by this. I don’t like piling on especially with security vulnerabilities, but man how many red flags do you need to ignore? They won’t stop abusing us until we stop using their products.

> They won’t stop abusing us until we stop using their products. I don't use AI at all in my daily life. Work however will demand you use it. AI is not here to help people.

> AI is not here to help people.

True, but it isn't here to not help people, either.

It's a spanner. Who wields the spanner, makes all the difference.

We've spent the last couple of decades, cultivating a huge crop of ultimate scumbag billionaires, with comically exaggerated sociopathy, and that has filtered down to almost every level of society. They are treated as gods, these days (they certainly think of themselves that way).

It still shocks me (but really shouldn't), on a daily basis, to encounter regular folks, interacting in stores and restaurants, or driving on roads, that mirror the values systems exemplified by our billionaires. Our politicians act that way, and one of their biggest selling points, is normalizing sociopathy (not just the US, either).

Re: Grok CLI uploaded the whole home directory to GCS

#246

Post by Demiurge »

butlike wrote: post #211
k8sToGo wrote: post #201

Why do people run and install these agents locally? No container nothing. I am running Opencode in WSL2 with the windows mounts disabled.

So the idea is that these should be treated as programs in an extremely low trust environment, akin to running malware in a VM?

Yes, I think if agents as interns with enough smarts to be dangerous.

Re: Grok CLI uploaded the whole home directory to GCS

#247

Post by khalic »

dkuntz2 wrote: post #241
khalic wrote: post #128

Earlier quoted context omitted.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

i give a lot of software dedicated user accounts, it's literally one of the core security models of the operating system

But none of these services have the kind of latent capabilities an agent has, you know a deterministic service’s constraint are its code+bugs. There are no such constraints in an agent…

Re: Grok CLI uploaded the whole home directory to GCS

#249

Post by ChrisMarshallNY »

Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

True, but that's a fantasy happy path. It will never happen, for most people. Only HN people will do that.

It needs to be baked into the OS.

At that point, HN users start screeching about it, so it's lose/lose, really.

Re: Grok CLI uploaded the whole home directory to GCS

#250

Post by thwarted »

dcow wrote: post #182
danlitt wrote: post #158

Earlier quoted context omitted.

Same reason people give postgres, php, or any other program a user account.

Why should it be? We have containers and capabilities…

Containers are often used with user namespaces, which is literally another (set of) user account(s).
Post reply on HN