Grok CLI uploaded the whole home directory to GCS • Hacker News Board

Re: Grok CLI uploaded the whole home directory to GCS

#251

Post by WhyNotHugo » Mon, Jul 13, 2026, 4:06 PM UTC

_verandaguy wrote: post #155

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

> Trying to use markdown files to limit access should never be treated as a security guarantee at all.

This is akin to politely asking guests to to steal your jewels. If your jewels are in the living room, and your guests have unfettered access to the living room, this technique will only work for the most trustworthy of guests.

Re: Grok CLI uploaded the whole home directory to GCS

#252

Post by habosa » Mon, Jul 13, 2026, 4:06 PM UTC

Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

These tools are explicitly marketed as a way for non-technical people to code. If we expect those same people to understand sandboxing we're dreaming.

Re: Grok CLI uploaded the whole home directory to GCS

#253

Post by butlike » Mon, Jul 13, 2026, 4:07 PM UTC

graemep wrote: post #148

wolttam wrote: post #72

Earlier quoted context omitted.

This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server. I don't think it is reasonable to expect every user (including those just starting out with the tools - maybe experimenting, maybe younger/less experienced in general) to think that the tool they're running for the very first time is going to automatically exfiltrate all of their data. It's…

I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not. Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it? A lot of users are fine with everything being uploaded. Most people's pri…

Every driver needs to learn how to drive, that's why it's called a "driver's license"

Re: Grok CLI uploaded the whole home directory to GCS

#254

Post by khalic » Mon, Jul 13, 2026, 4:07 PM UTC

Izkata wrote: post #144

khalic wrote: post #128

Earlier quoted context omitted.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

...this is a completely normal thing to do in linux, it's the most basic form of access control. There's like a dozen non-human accounts in a clean install before adding your own like this, and a lot of software adds their own. Edit: I have 54 entries on my personal laptop, just one of which is actually me.

This model is already not perfect, and not at all built for agents. The only way to secure an agent is an air-gap with the execution layer. Treat it like text, and the problem never arises until you “interpret” the agent output in a more limited environment than the OS

Re: Grok CLI uploaded the whole home directory to GCS

#255

Post by WhyNotHugo » Mon, Jul 13, 2026, 4:08 PM UTC

Dacit wrote: post #213

__MatrixMan__ wrote: post #96

Earlier quoted context omitted.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

You will want at least a separate session for the `restricteduser`: E.g. with X11, a process in the same session can do almost anything with your input/output. And most Linux distributions make it really hard to disable external device access for individual users...

> And most Linux distributions make it really hard to disable external device access for individual users...

For any distro that relies on the traditional plugdev group, just don't add those users to the plugdev group. Which would be the default when creating a user anyway.

Re: Grok CLI uploaded the whole home directory to GCS

#256

Post by thesuitonym » Mon, Jul 13, 2026, 4:09 PM UTC

_verandaguy wrote: post #155

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

It's wild that we've known for decades to use ACLs to make sure people don't have access to files we don't want them to have access to, but somehow a computer pretending to be a person doesn't get that same treatment.

Re: Grok CLI uploaded the whole home directory to GCS

#257

Post by khalic » Mon, Jul 13, 2026, 4:09 PM UTC

anvuong wrote: post #160

khalic wrote: post #128

Earlier quoted context omitted.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

What kind of logic is this? It's standard in the Linux world to give important services a separate user domain.

The standard here is not enough when the agent can escalate by finding 0 days, for example. It’s like giving a black hat a limited account. Sure it might restrict him, but not giving him an account at all is way better

Re: Grok CLI uploaded the whole home directory to GCS

#258

Post by khalic » Mon, Jul 13, 2026, 4:10 PM UTC

12345ieee wrote: post #178

khalic wrote: post #128

Earlier quoted context omitted.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

Unix users are THE tool to restrict tool permissions, at any given time there's 20+ services on a Unix machine that run in their user.

And how many of those services can check your box and find permission escalation strategies on its own?

Re: Grok CLI uploaded the whole home directory to GCS

#259

Post by WhyNotHugo » Mon, Jul 13, 2026, 4:10 PM UTC

lobo_tuerto wrote: post #35

The real solution to these kind of problems is sandboxing. I use podman through a bash script to launch a container whenever I want an agent to work on one of my repos. When done I just generate git patches and port back everything generated. In this way I'm not afraid of letting the agents totally lose on my computer.

Quick Alpine container with the current directory mounted as the current directory:

    docker run --rm -it -v $(pwd):/src -w /src alpine sh

Replace alpine with your favourite Linux distro or image.

Note entirely perfect, but will be enough against anyone not actively exploiting kernel privilege escalation bugs.

Re: Grok CLI uploaded the whole home directory to GCS

#260

Post by jsolson » Mon, Jul 13, 2026, 4:10 PM UTC

ChrisMarshallNY wrote: post #249

Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

True, but that's a fantasy happy path. It will never happen, for most people. Only HN people will do that. It needs to be baked into the OS. At that point, HN users start screeching about it, so it's lose/lose, really.

macOS largely _does_ bake this into the OS, and it is annoying. They also provide a way to turn it off for specific applications (including, for example, Terminal.app).