FAFO when you run software that has no problem creating CSAM and is owned by a literal fascist lmao
Grok CLI uploaded the whole home directory to GCS
391–400 of 434 posts
Re: Grok CLI uploaded the whole home directory to GCS
#392Earlier quoted context omitted.
I seem to recall reading about agents already breaking out of containers.
Last time I read about this, this was due to the well-known pitfall of UID mapping across container boundaries. It's a common misconfiguration and one of the footguns available through containers, which I don't say a wholesale condemnation of the technology, but certainly as a UX facet that could use reevaluation.
I've been biasing towards VMs myself just out of caution, but maybe that's just extreme paranoia.
The way I look at it is similar to how I'd look at any hypothetical employee. How do I ensure the agent only has access to the minimum possible they need to get their job done?
That means no access to git repositories (no pushes on my behalf means it can't accidentally nuke git history, something there is anecdotal evidence of agents doing). It can make local changes in git only and I will take responsibility for pushing them. No access to the wider internet beyond what I deem acceptable. No permissions to access any internal APIs except what I provide (and not using my credentials).
In one case, I have a tool that has a set of dangerous commands alongside a large number of safe ones. I don't even have it installed in the agent's VM. I run an MCP that is a simple python wrapper around the tool on the host side, and expose it to the agent in the VM, so that it can only possibly run a strict safe subset that I can trust it with access.
Re: Grok CLI uploaded the whole home directory to GCS
#393Earlier quoted context omitted.
What bad practices are you imagining?
Idk, did you see the whole DOGE thing? Maybe Edolf has resorted to hiring script kiddies because nobody with a developed moral compass will work for his companies anymore.
Hmm. This is striking me as low quality speculation based on Elon’s name being in both stories.
Re: Grok CLI uploaded the whole home directory to GCS
#394So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.
I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…
One cannot pound that particular drum enough. "Guardrails" in instructions (and all MD files are just instructions) are like price lists at an unattended farm stand. It'll usually work! There will be some money in the basket at the end of the day! People paid for the bagels[0]! But one cannot never assert that it _will_ work; things that _must_ work have to managed out-of-band
[0] https://pubs.aeaweb.org/doi/pdfplus/10.1257/0002828067772121...
Re: Grok CLI uploaded the whole home directory to GCS
#395Earlier quoted context omitted.
They upload your ssh keys too?
They might, if you use your home directory as the project directory, given that they only mention using gitignore as the blacklist.
More info:
https://forum.cursor.com/t/codebase-indexing/36/18
So file contents are uploaded for embedding/indexing, but supposedly none of those contents are stored at Cursor after embedding.
Re: Grok CLI uploaded the whole home directory to GCS
#396Running LLM outside of the repo directory (home directory in this case) is a big no-no. Beyond that, this is highly concerning behavior of Grok.
Re: Grok CLI uploaded the whole home directory to GCS
#397I am genuinely fascinated by this. I don’t like piling on especially with security vulnerabilities, but man how many red flags do you need to ignore? They won’t stop abusing us until we stop using their products.
Lazy or incapable people will do almost anything once it is normalized behavior, which vibe coding has become, to avoid having to do actual work. Even if there were cryptominers running, eating up 80% of their cores and stealing electricity, they would still let it happen. It's not their money or hardware being spent.
Re: Grok CLI uploaded the whole home directory to GCS
#398Earlier quoted context omitted.
> They won’t stop abusing us until we stop using their products. I don't use AI at all in my daily life. Work however will demand you use it. AI is not here to help people.
> AI is not here to help people. True, but it isn't here to not help people, either. It's a spanner. Who wields the spanner, makes all the difference. We've spent the last couple of decades, cultivating a huge crop of ultimate scumbag billionaires, with comically exaggerated sociopathy, and that has filtered down to almost every level of society. They are treated as gods, these days (they certainly think of themselve…
Exactly. I couldn't have said it better. I hope I will still live to see the pitchforks coming out and taking all of this crap down, but I fear it might be longer than a lifetime, before we rid ourselves of these parasites.
Re: Grok CLI uploaded the whole home directory to GCS
#399Earlier quoted context omitted.
Have you ever tried to configure ACLs? They're a pain in the ass. Not everyone wants to be a sysadmin.
What do you find hard about it? Is it a conceptual thing or the tools themselves? I'm very far from a sysadmin, but it's just such a ground level using-linux type thing in my brain, I don't think I ever thought I had a choice about learning it!
Owner/Group/World rwx permissions are ground-level. I'm not sure I'd put ACLs, or SELinux, or AppArmor in the same sphere. Those start of at "arcane" and then get more complicated, at least that's my impression, and I've used linux for decades.
Re: Grok CLI uploaded the whole home directory to GCS
#400Earlier quoted context omitted.
I don't understand these people. Agent instructions in markdown is barely a suggestion. I have one which says "All code in this repository is executed in docker containers, run the services with `docker compose run --rm php-cli "$@"`. Gemini and Claude more often than not refuse to abide and will try to execute the environment using /opt/homebrew/bin/php on my host…
A frightening amount of people have no idea how AI tools work, even those that should know better. I have seen senior software developers fall for the mistake of believing an LLM output when it spews bullshit about how its own memory or restrictions work. LLMs will listen to you and follow your instructions and restrictions most of the time, which seems to be enough for people to believe that they will every time. I'…
LLMs are the first massively popular type of computer programs which actively trying to break half a century worth of human training, which basically distills to "computer programs are highly deterministic and if they work, they are outputting correct predictable results every time" (I'm talking about average population subconscious opinion here, no need to list exceptions). Average person still can't comprehend how LLM output is random all the time and how the identical query to the same program version will produce variable results again and again.
I wonder what will happen after our benevolent prophets St.Sam and St.Dario will succeed in re-training humanity and break this collective expectation of program correctness. I guess they didn't even think about that.