Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tricked Claude into leaking your deepest, darkest secrets

ayush.digital

Post reply on HN
Print view View original

191–200 of 317 posts

Re: I tricked Claude into leaking your deepest, darkest secrets

#191

Post by kstenerud »

akazantsev wrote: post #33
artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl. To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.) There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I devel…

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there:

- Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker

- Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).

- Network control

- Secrets control (file mounts or credentials broker)

- NO ambient data (ENV is replaced with a minimal and local-to-sandbox one)

- NO access to your homedir. You have to explicitly mount things you want.

- NO direct access to your workdir: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs sandbox side in case the repo has filters.

- gitignored files never get copied in. The agent never sees them.

- Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want.

- Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal.

- Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy

- MCP passthrough

- Layered API (golang) if you want to sandbox other things

- Self-contained binary. No external requirements other than the backends you want to use. Defaults to a ~/.yoloai dir for config/data, but you can point it anywhere.

- FOSS

https://github.com/kstenerud/yoloai

Re: I tricked Claude into leaking your deepest, darkest secrets

#193

Post by Narretz »

ahk-dev wrote: post #113
artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

I think we're converging on two separate security models. One is capability minimization (filesystem, network, shell permissions). The other is context minimization. An agent that only has access to the files and memories relevant to the current task is much less dangerous even if it has the same tool permissions. We already optimize context for cost; I suspect we'll end up treating it as a security boundary too.

I'd say there's also oversight/supervision. Which was manual at the start with a human signing off on commands/incrementally built allow/block lists, and now seperate models evaluating commands and blocking them based on some parameters. This is the weakest model, but it'll evolve as well.

Re: I tricked Claude into leaking your deepest, darkest secrets

#194

Post by TomK32 »

ConorSheehan1 wrote: post #53
artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

Containers don't even really help that much because they share the host file system. Need a VM, and even then, agents have escaped them!

They only do if you give your container that file system as a volume.

Re: I tricked Claude into leaking your deepest, darkest secrets

#195

Post by pfortuny »

torginus wrote: post #95
squidsoup wrote: post #50

Earlier quoted context omitted.

> That's because sandboxing is quite hard colima makes it pretty easy, on macOS and linux at any rate. https://colima.run

Still wild to name a sandboxing software after one of the most infamous Soviet Gulags in history.

Colima is in Mexico.

Kolyma is in Russia.

Re: I tricked Claude into leaking your deepest, darkest secrets

#196

Post by lukewarm707 »

artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

well, yes, my agent does have root access to my personal pc and the keys to my pass manager.

its not autonomous and runs local llms, i use it to run terminal commands in natural language. so its more like a better version of the terminal.

eg 'here are 25 audio files, combine them, write a transcript'

and it deals with ffmpeg

Re: I tricked Claude into leaking your deepest, darkest secrets

#197

Post by brk »

tmikaeld wrote: post #116
inopinatus wrote: post #61

Earlier quoted context omitted.

I’ve been recommending the use of consistent lies about name and date of birth to online systems since Eternal September began. Very few sites and systems justify accurate PII, and even for those I often still maintain dual accounts/profiles as necessary.

That never works on Facebook though, because as soon as a ”friend” reports that ”I’m not me” then the account will be permanently banned. That also triggers for photos that’s not genuinely me, like a pet or drawing as portrait.

Never? Facebook is pretty overrun with what are basically fake profiles. Hell, I've been curating an alter ego on Facebook for over a decade. Built up a profile with several dozen "friends" that are all kind of interconnected and regional, but of course none of them have ever met "me" IRL, and the profile picture is a funny-ish celeb pic. Facebook has millions of legit users that are "friend collector" types, and won't think twice about engaging with an account that gently strokes their online ego with likes, "Happy Birthdays", etc.

Re: I tricked Claude into leaking your deepest, darkest secrets

#198

Post by wafflemaker »

graemep wrote: post #136
vladms wrote: post #111

Earlier quoted context omitted.

I do not know since when (I am using it for couple of years), but in Arch, it is very simple to have two X sessions (by using "log out" > "switch user") for two different accounts, so switching it's just a Control-Alt-F7 away. Additionally, one can make the main user part of the group of the development user, so that you can read/write easy in the development user account and it is even easier to share stuff.

Multiple X sessions has been possible for decades. I think its possible with Wayland too. You can also start applications as another user so you do not even need multiple sessions. There are quite a lot of privilege escalation attacks so I am not sure this is sufficiently solid.

It's off topic, and it was also possible for decades, but:

you can connect two sets of mouse, keyboard and monitor to one PC and have two people using it, each running their own X session. The true multi boxing!

Re: I tricked Claude into leaking your deepest, darkest secrets

#199

Post by brk »

rlpb wrote: post #98
inopinatus wrote: post #61

Earlier quoted context omitted.

I’ve been recommending the use of consistent lies about name and date of birth to online systems since Eternal September began. Very few sites and systems justify accurate PII, and even for those I often still maintain dual accounts/profiles as necessary.

I like using a date of birth of 1 January. It's plausible but also hopefully suspicious how many people seem to be born that day if others do the same.

I use the 1st of my birth month. Slightly less suspicious? It's at least a little easier to remember. Generate fake profiles and identities usually is easier when you have bits that are rooted in your actual reality. Like, you have the same zodiac sign either way in this case, so you don't have to remember two of everything. Or if you're talking about a birthday trip, or related birthday thing from the past, details about the weather would be consistent, etc.

Re: I tricked Claude into leaking your deepest, darkest secrets

#200

Post by himata4113 »

Somewhat related, but recently I've setup a site for my friend that is a contractor and I have a form that requests the address, name, email OR phone for contact. What I noticed is that people not only put their exact address into it, but also their full legal name, email AND phone number...

Now I believe the biggest threat to personal information exfiltration are the people themselves and there's quite literally nothing you can do about it.

Post reply on HN