Earlier quoted context omitted.
[flagged]
By this standard, you should never trust a directory. Since it will push your env secrets.
You shouldn’t have secrets in your environment.
Grok CLI uploaded the whole home directory to GCS
361–370 of 434 posts
Re: Grok CLI uploaded the whole home directory to GCS
#362[flagged]
Re: Grok CLI uploaded the whole home directory to GCS
#363Earlier quoted context omitted.
it is not about "security" but it is more about confinement. And how could it do that without sudo rights?
Still, you are barely more protected than someone running this as non root at home. By your same logic you could “confine” the agent to any arbitrary directory on your filesystem and say it’s sufficient.
Yes, that is exactly the point I am making. The agent / cli is confined within the WSL2 environment. How is it "barley" protected? Neither you nor the other guy have yet answered this question.
I never claimed WSL2 is a security sandbox. I am saying running it in a container or WSL2 allows you to severly limit the blast radius. I am not expecting the agent to be malicious, but I am expecting it to do unexpected things.
Re: Grok CLI uploaded the whole home directory to GCS
#364the 'upload your home directory to our servers' feature is the kind of thing that used to require a warrant and now it's just a Tuesday afternoon bug report
It’s not a bug, it’s a feature.
Re: Grok CLI uploaded the whole home directory to GCS
#365[dead]
Re: Grok CLI uploaded the whole home directory to GCS
#366I made a tool to solve this problem (at least on Linux, though I believe there's a way to achieve something similar on MacOS): https://github.com/swelljoe/flar It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path. The agent or any command it runs can't reach outside of it even if you tell it to (or, more dangerously, a random prompt injection from t…
"FLAR is the Fast Light Agent Restrictor. It runs on rocks called gars." what is rocks and what is gars?
It's a dumb joke. https://youtube.com/watch?v=AgIAjsiX_o8
Re: Grok CLI uploaded the whole home directory to GCS
#367Earlier quoted context omitted.
> They won’t stop abusing us until we stop using their products. I don't use AI at all in my daily life. Work however will demand you use it. AI is not here to help people.
> AI is not here to help people. True, but it isn't here to not help people, either. It's a spanner. Who wields the spanner, makes all the difference. We've spent the last couple of decades, cultivating a huge crop of ultimate scumbag billionaires, with comically exaggerated sociopathy, and that has filtered down to almost every level of society. They are treated as gods, these days (they certainly think of themselve…
Wasn't ai introduced so replace people? It's not the spanner, it's the car and we're the horses
Re: Grok CLI uploaded the whole home directory to GCS
#368Earlier quoted context omitted.
It's a spanner where every quarter turn costs noticeable money. Which directly funds behavior like this. The tool analogy is intentionally minimizing, and doesn't capture just how different rented tools with constant surveillance are.
Doesn’t absolve the spanner-wielder from responsibility, though. We live in an age, where the mere thought of personal Responsibility is terrifying.
Yes, I mean it in the sense that the spanner itself and who the spanner funnels money to is so bad that anyone using it has automatically accepted themselves being that bad. Unlike most tools (which the tool analogy leans on heavily), it's very much not an impartial tool, there is no such thing as "using it responsibly" when you're paying Musk.
Re: Grok CLI uploaded the whole home directory to GCS
#369Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…
These tools are explicitly marketed as a way for non-technical people to code. If we expect those same people to understand sandboxing we're dreaming.
This is a fight I deal with every day. We have folks in the technology group at work who use AI to write code and do so without issue. But now folks in supply chain or in the executive suite are using it to generate web pages that they want published or apps they want on the internet, and while Claude can generate an HTML file how that gets published, how authentication works, etc is just glossed completely over, and generates a ton of work for the IT team to build up around this stuff as it comes in
Re: Grok CLI uploaded the whole home directory to GCS
#370Earlier quoted context omitted.
What should it do then? The whole point of LLMs is that you can stop writing rigorous rules in a programming or config language with hard-to-learn syntax, and can resort to natural language instead. You pay for that with the chance for misunderstandings rising to similar levels as in human interaction. That's the tradeoff. Always has been, always will be.
Have the comments been combined with another story? Because this isn't about a LLM reading and sending contents of the file to be processed, but the agent framework uploading every single file in /home/user to a random server.
Yes, but the underlying problem is a lack of exact specification what the agent is allowed or not allowed to do. It must have access to some (most?) of my files (but I'm too lazy to specify which ones exactly, e. g. by setting appropriate filesystem permissions). It must have access to some servers (but not those that I consider "random", which again I'm too lazy to specify). It is even expected to upload files (e. g. by checking them into git and pushing, or to reason about them in case I'm not running a local version of Grok). But please - not to a server that I deem "random". (And again, I of course won't tell you what makes a "random" host via exact firewall rules or anything like that!)
We have a lot of implicit assumptions when it comes to security. If we leave out the step of formalizing these assumptions into exact rules and instead stick to ambiguous and unclear natural language all the time, then these things will happen.
(Addendum: But indeed, the failure to formalize our assumptions into enforcable rules isn't specific to agents / LLM-based applications. For any desktop app, we have implicit assumptions like "please only read and write your own config files", that we never care to enforce via filesystem permissions, running them in a vm or similar. But with these almighty agents that are supposed to guess our will from just a couple of words, the risk of them violating our unwritten assumptions gets so much higher...)