Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

341–350 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#341

Post by Stromgren »

embedding-shape wrote: post #222
Stromgren wrote: post #218

Earlier quoted context omitted.

This was posted on HN yesterday: https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75f... If it’s to be trusted, it has nothing to do with the “agent” or what’s sent to the LLM. The harness will just straight up package the folder it’s run from and upload it to Google Cloud Storage.

> If it’s to be trusted, it has nothing to do with the “agent” or what’s sent to the LLM. The harness will just straight up package the folder it’s run from and upload it to Google Cloud Storage. Even if there is a misunderstanding who is really uploading the directory, the TUI/CLI itself by actual code, or if the model decided to do so in the session, if you apply the recommendations from the replies to parent, and…

No I disagree. A harness reading a file is a tool call and it happens locally, which means that I can control it. I can configure that I need to permit any file reads and now I _should_ have control of what is sent. The difference between that and silently uploading my entire working directory in the background is miles apart IMO.

I understand that one should think carefully about how they work with a non-deterministic tool, but this if different completely. This is xAI just choosing to upload and store everyone’s directories - with full git history.

Re: Grok CLI uploaded the whole home directory to GCS

#342

Post by chrisjj »

jrm4 wrote: post #84

I feel like a lot of people here are understating this issue. This is a stupid stupid thing to "allow," for every party involved here. You're a stupid programmer if you're letting these things touch your files. You're a stupid company if you're letting Grok run wild. We're a stupid industry if we're not warning everybody about how ridiculous this all is.

> You're a stupid programmer if you're letting these things touch your files.

> We're a stupid industry if we're not warning everybody

Hmm. Annoy everybody just to warn the stupid few?

I prefer the current solution. Leave the targetting to the chatbots.

Re: Grok CLI uploaded the whole home directory to GCS

#344

Post by SwellJoe »

I made a tool to solve this problem (at least on Linux, though I believe there's a way to achieve something similar on MacOS):

https://github.com/swelljoe/flar

It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path. The agent or any command it runs can't reach outside of it even if you tell it to (or, more dangerously, a random prompt injection from the web or some third party library or script that the agent runs).

I was using VMs to solve this problem but the temptation to start an agent to work directly on my machine for GUI apps and the like was motivation enough to find an alternative to VMs.

I wouldn't use Grok, became I really don't trust Musk, but even the models I do kinda trust to have good judgement I don't trust enough to let them have unrestricted access to my personal machines and all my credentials.

Re: Grok CLI uploaded the whole home directory to GCS

#345

Post by ChrisMarshallNY »

Groxx wrote: post #298
ChrisMarshallNY wrote: post #245

Earlier quoted context omitted.

> AI is not here to help people. True, but it isn't here to not help people, either. It's a spanner. Who wields the spanner, makes all the difference. We've spent the last couple of decades, cultivating a huge crop of ultimate scumbag billionaires, with comically exaggerated sociopathy, and that has filtered down to almost every level of society. They are treated as gods, these days (they certainly think of themselve…

It's a spanner where every quarter turn costs noticeable money. Which directly funds behavior like this. The tool analogy is intentionally minimizing, and doesn't capture just how different rented tools with constant surveillance are.

Doesn’t absolve the spanner-wielder from responsibility, though.

We live in an age, where the mere thought of personal Responsibility is terrifying.

Re: Grok CLI uploaded the whole home directory to GCS

#347

Post by fwlr »

ch_sm wrote: post #305
fwlr wrote: post #87

Is the Grok CLI a 2 terabyte install? Did Elon dropship you an 8U rack of B200s? No? Well the model weights, the GPUs, and the context obviously all have to be in the same place, so “sending your project to them” is literally the only thing that could possibly happen, unless you think agents work by fucking magic . This is the biggest case of PEBKAC in history, maybe ever. This is the kind of confusion that Charles B…

that‘s … not really how it works. Agents get your code into their context via tool calls, not by uploading the entire file to a server „where the weights live and thus the code has to be too“. Small but crucial difference. Aside from that: LLM providers have to be the ones that facilitate your privacy and security by default. That‘s not on the user. They‘re tool providers and they can‘t compromise you and your org by…

What do you think a tool call is? What is this small but crucial difference between a `read_file` tool call and `scp`?

If your contention is just that this should upload files one by one instead of all at once, what you want is for providers to facilitate the illusion of privacy.

Re: Grok CLI uploaded the whole home directory to GCS

#348

Post by Bender »

LetsGetTechnicl wrote: post #316
Bender wrote: post #34

A bot will do what a bot can do whether malicious or accidental. One should assume they are giving DOGE shell access on their computer and adapt accordingly. I am trying to imagine the SELinux rules required to make a bot play nice and the more I think about it such rule complexity may even befuddle the NSA. Alternate methodology: - Give the bot it's own machine and only copy to it that which one would want DOGE havi…

Sounds like a lot of work just for it to maybe not work anyways

Absolutely. Quite a bit of work one time by one person willing to document the steps or even better create automation scripts for Ansible, Docker, Podman, Systemd, etc... and then automation for everyone using agents. As to success I would suggest it may be better than zero visibility or trusting what the agent says it did. Due diligence and a repeatable standard as apposed to running with scissors.

This is probably most important for anyone operating agents on corporate systems. I would suggest corporate security should take interest in this idea so they have a good answer for auditors, insurance companies, investors and customers. A full audit trail of what every agent had access to and ingested.

Re: Grok CLI uploaded the whole home directory to GCS

#350

Post by tarnith »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

In what universe would a sane person allow any LLM or remote calling software access to their user folder with sensitive data in it?

I swear, people hear the word LLM and their brain resets when it comes to good software practices.

Did VMs suddenly stop existing? Kata containers? An RHEL box with SEL?

It's like there's a new technology and everyone suddenly decided to shutoff their brain when it comes to basic security.

Post reply on HN