Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

261–270 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#261

Post by gowld »

__MatrixMan__ wrote: post #96
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

Users do not want the agent to be restricted. They want the agent to read the user's mind and resolving the user's cognitive dissonance and contradictory preferences.

Re: Grok CLI uploaded the whole home directory to GCS

#262

Post by kerng »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

What happened here is not related to agentic behavior or instructions in .md files. It's a binary a user runs, it scoops up their files and sends them to a third-party.

And the user even paid $99/month or more for having their data leaked.

Re: Grok CLI uploaded the whole home directory to GCS

#263

Post by khalic »

thwarted wrote: post #250
dcow wrote: post #182

Earlier quoted context omitted.

Why should it be? We have containers and capabilities…

Containers are often used with user namespaces, which is literally another (set of) user account(s).

Yes but the encompassing service has the account, not the agent. You can completely segregate it from the rest of the system, like you’d treat an intruder

Re: Grok CLI uploaded the whole home directory to GCS

#264

Post by gowld »

khalic wrote: post #257
anvuong wrote: post #160

Earlier quoted context omitted.

What kind of logic is this? It's standard in the Linux world to give important services a separate user domain.

The standard here is not enough when the agent can escalate by finding 0 days, for example. It’s like giving a black hat a limited account. Sure it might restrict him, but not giving him an account at all is way better

The black hat can find 0-day escalation in your sandbox, too.

A user account is a sandbox.

Re: Grok CLI uploaded the whole home directory to GCS

#265

Post by butlike »

fwlr wrote: post #138
notavalleyman wrote: post #107

Earlier quoted context omitted.

Haha so just send over your entire home directory including password managers and home videos every time you need some python code rewritten. Only a buffoon would be confused by the straightforward logic.

If you decide that your entire home directory is the project, as the OP did by setting the repo_path to ~/, then, well… I mean, if you ask me, I don’t recommend it, but it’s your computer and your free will.

Then that should be considered a 'nuke button' and nuke buttons don't find themselves into well-designed software for the simple fact that an end user shouldn't have to worry about shooting themselves in the foot. Again, with good software.

Re: Grok CLI uploaded the whole home directory to GCS

#267

Post by khalic »

gowld wrote: post #264
khalic wrote: post #257

Earlier quoted context omitted.

The standard here is not enough when the agent can escalate by finding 0 days, for example. It’s like giving a black hat a limited account. Sure it might restrict him, but not giving him an account at all is way better

The black hat can find 0-day escalation in your sandbox, too. A user account is a sandbox.

Not as air tight as a container

Edit: it’s about the attack surface

Re: Grok CLI uploaded the whole home directory to GCS

#268

Post by LightBug1 »

simonw wrote: post #71

Important to clarify that this was not the Grok agent deciding to read the files. I don't think the LLM had anything to do with this decision at all. It looks like the Grok tool starts a session by deterministically kicking off a full upload of the user's current repository (and maybe their directory if not version tracked? Not clear if this user had previously run "git init" in their home directory) to Grok's server…

Jesus ... I feel a Bill Hicks sketch coming on ...

Re: Grok CLI uploaded the whole home directory to GCS

#269

Post by Twirrim »

_verandaguy wrote: post #155
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

The easiest, most guaranteed way to isolate it is to run it in a VM or container where it literally can't do the wrong thing without some kind of full container or VM exit exploit.

It's not hard, it's trivial. Most folks here are constantly working with containers. You know how to run a container with a local directory mounted in it.

For myself, I've been using Lima (https://lima-vm.io/) to reduce even that little bit of extra work. Lima works cross-platform leveraging native virtualisation or containerisation, and has some useful capabilities for using agents.

Re: Grok CLI uploaded the whole home directory to GCS

#270

Post by _verandaguy »

thesuitonym wrote: post #256
_verandaguy wrote: post #155

Earlier quoted context omitted.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

It's wild that we've known for decades to use ACLs to make sure people don't have access to files we don't want them to have access to, but somehow a computer pretending to be a person doesn't get that same treatment.

ACLs, nothing, we've known about in-band signalling since forever and still this whole segment of the industry seems to either not know about it, or forgets about it at a cadence so regular it may as well not know about it.

System-level ACLs; mandatory or discretionary access control; secure-by-default application and network configurations are all for naught if you take an LLM, run it with all the privileges you'd have an accountable, judgemental operator, and then tell it to act based on arbitrary untrusted input which might include prompt injection attacks, something which cannot generally be sanitized.

Well-defined, well-enforced security policies can mitigate disasters, but many in the wild right now just don't account for this kind of threat model.

Post reply on HN