371–380 of 434 posts
Now you trust a single GH user rather than a company. Fair enough. I just think it's very paradoxical.
Well, it looks like he was running the agent in his home directory to begin with considering the `repo_path` field is exactly that.
Sure, but it's easy to accidentally start up the agent in the wrong directory, like when you open a new terminal. I've done it before when I was distracted (albeit with Claude, not Grok).
TLDR: Ran grok in $HOME. Surprised agent read content of folder. On the other hand, I specifically had grok try hard NOT to read a known key in the project dir (it only saw the first part using a tool, to verify it was present). So there's that.
Did it really need to read all of $HOME and everything under it?
So is X going to claim the user disabled something the second before everything went south? That's what the owner's other company does.
the user literally added their home directory as a trusted directory. there's nothing to "claim"
Earlier quoted context omitted.
Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.
> cat /etc/passwd|wc -l 50
Earlier quoted context omitted.
I built a docker container that volume mounts the project directory
You can even go a step further and run the container in a VM, such as with Docker Sandbox or the krun runtime in Podman. There's also smolvm which is a nice minimal microvm manager based on libkrun: https://github.com/smol-machines/smolvm . I vibe coded a little shell utility for building and running OCI images for the Pi harness using it (easy enough to do manually, but the automation just makes it a couple quick co…
Earlier quoted context omitted.
I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…
It's wild that we've known for decades to use ACLs to make sure people don't have access to files we don't want them to have access to, but somehow a computer pretending to be a person doesn't get that same treatment.
Earlier quoted context omitted.
I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…
The easiest, most guaranteed way to isolate it is to run it in a VM or container where it literally can't do the wrong thing without some kind of full container or VM exit exploit. It's not hard, it's trivial. Most folks here are constantly working with containers. You know how to run a container with a local directory mounted in it. For myself, I've been using Lima ( https://lima-vm.io/ ) to reduce even that little…
Alex Karp was right, AI Compagnies are stealing people code while making them pay for unproductive tokens
Earlier quoted context omitted.
Still, you are barely more protected than someone running this as non root at home. By your same logic you could “confine” the agent to any arbitrary directory on your filesystem and say it’s sufficient.
Yes, that is exactly the point I am making. The agent / cli is confined within the WSL2 environment. How is it "barley" protected? Neither you nor the other guy have yet answered this question. I never claimed WSL2 is a security sandbox. I am saying running it in a container or WSL2 allows you to severly limit the blast radius. I am not expecting the agent to be malicious, but I am expecting it to do unexpected thing…