Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

281–290 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#281

Post by kstenerud »

I built yoloAI for this kind of nightmare scenario (among others).

- The sandboxed agent has no access to your homedir, or ANY dir on your machine except what you explicitly give it access to.

- Even with your workdir, it honors .gitignore and refuses to copy in any ignored paths to the sandbox copy.

- The sandboxed agent doesn't have access to your ENV (unless you explicitly pass things through one-by-one).

- Networking can be restricted any way you like.

- Credentials are proxied (currently Claude only), so the agent has access to NO secrets at all.

- You pick the security backend to match your needs (containers, VMs, etc).

- It's FOSS.

https://github.com/kstenerud/yoloai

Re: Grok CLI uploaded the whole home directory to GCS

#282

Post by Anon1096 »

k8sToGo wrote: post #201

Why do people run and install these agents locally? No container nothing. I am running Opencode in WSL2 with the windows mounts disabled.

If the agent you are running really wanted to it could easily find a way to mount the windows folders and read them all. WSL isn't a security boundary, you are only barely more protected than people running grok in their home directory.

Re: Grok CLI uploaded the whole home directory to GCS

#283

Post by chrisweekly »

james_marks wrote: post #274
_verandaguy wrote: post #155

Earlier quoted context omitted.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

1000%. I'm experimenting with running my agent (Claude Code) inside a docker container, so I can have a control plane and then YOLO within that limited access. The agent could still mangle my local dev setup, but I consider that an acceptable risk since everything the agent has access to is under version control outside the local machine. This is a new pattern for me, I'm curious what others are doing.

https://smolmachines.com has "smolvm" microvms with better performance and ergonomics and security than docker, you might want to give it a try. (No affiliation, I just like what they're doing.)

Re: Grok CLI uploaded the whole home directory to GCS

#284

Post by whatjustin »

_verandaguy wrote: post #155
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

If you're not using a sandbox, something like this will inevitably happen to you. It's really not that hard to set up and should be a standard recommendation.

Re: Grok CLI uploaded the whole home directory to GCS

#285

Post by mdavidn »

_verandaguy wrote: post #155
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

Especially when I find that, when I ask an agent not to do something, the mere mention seems to put the "idea" in its "head," making it more likely to ultimately do that thing.

Re: Grok CLI uploaded the whole home directory to GCS

#286

Post by liuliu »

simonw wrote: post #71

Important to clarify that this was not the Grok agent deciding to read the files. I don't think the LLM had anything to do with this decision at all. It looks like the Grok tool starts a session by deterministically kicking off a full upload of the user's current repository (and maybe their directory if not version tracked? Not clear if this user had previously run "git init" in their home directory) to Grok's server…

This should be the first comment here.

Too many replies here are done before reading it. It is not "just another agent does the agent thing". It is a deliberate choice of the Grok Build team to have a toggle from the server to let the program to upload your entire codebase to a Google Cloud Storage bucket. It is not an agent decision, the program is written by the Grok team, can be dissembled and seeing the logic wild-open.

Re: Grok CLI uploaded the whole home directory to GCS

#288

Post by chrisweekly »

khalic wrote: post #267
gowld wrote: post #264

Earlier quoted context omitted.

The black hat can find 0-day escalation in your sandbox, too. A user account is a sandbox.

Not as air tight as a container Edit: it’s about the attack surface

microvms are better than containers running on your host. see eg the "smolvm" microvms from https://smolmachines.com

Re: Grok CLI uploaded the whole home directory to GCS

#289

Post by HiPhish »

jeroenhd wrote: post #92
Y-bar wrote: post #57

Earlier quoted context omitted.

I don't understand these people. Agent instructions in markdown is barely a suggestion. I have one which says "All code in this repository is executed in docker containers, run the services with `docker compose run --rm php-cli "$@"`. Gemini and Claude more often than not refuse to abide and will try to execute the environment using /opt/homebrew/bin/php on my host…

A frightening amount of people have no idea how AI tools work, even those that should know better. I have seen senior software developers fall for the mistake of believing an LLM output when it spews bullshit about how its own memory or restrictions work. LLMs will listen to you and follow your instructions and restrictions most of the time, which seems to be enough for people to believe that they will every time. I'…

> LLMs will listen to you and follow your instructions and restrictions most of the time, which seems to be enough for people to believe that they will every time.

It's called automation bias. If something works 90% of the time the human mind will extrapolate that to be 100%. That's just how humans work.

https://en.wikipedia.org/wiki/Automation_bias

Re: Grok CLI uploaded the whole home directory to GCS

#290

Post by dbalatero »

swingboy wrote: post #15

Well, it looks like he was running the agent in his home directory to begin with considering the `repo_path` field is exactly that.

Sure, but it's easy to accidentally start up the agent in the wrong directory, like when you open a new terminal. I've done it before when I was distracted (albeit with Claude, not Grok).
Post reply on HN