I tricked Claude into leaking your deepest, darkest secrets • Hacker News Board

Re: I tricked Claude into leaking your deepest, darkest secrets

#211

Post by magimas » Wed, Jul 15, 2026, 12:07 PM UTC

kstenerud wrote: post #191

akazantsev wrote: post #33

Earlier quoted context omitted.

That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl. To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.) There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I devel…

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…

but this seems quite overkill no?

I currently run pi agent in Lima on a Mac with only the code project folder mounted and an extension that prevents pi agent from reading the contents of .env files directly.

Yeah, there probably are some freak situations where this isn't safe enough, but I don't really see any realistic ways this is going to end up badly. Am I overlooking some obvious security holes?

Re: I tricked Claude into leaking your deepest, darkest secrets

#212

Post by hmokiguess » Wed, Jul 15, 2026, 12:11 PM UTC

Tangential but I actually experienced recently something quite creepy and strange with Chat GPT iPhone app.

A close friend prompted it about some troubleshooting of a pet smart feeder and it responded with instructions but using my pet’s name to my friend.

I found that extremely strange for it to be a coincidence. My pet's name is not that generic for it to be in training data, and the connection to my friend makes it more strange to me.

That made me wonder if there’s cache pollution or some session data leakage in it exposing stuff. (My friend has been in our wifi for example)

Has anybody else noticed something like this?

Re: I tricked Claude into leaking your deepest, darkest secrets

#213

Post by archargelod » Wed, Jul 15, 2026, 12:11 PM UTC

vessenes wrote: post #208

GIANT thumbs down on no bug bounty from Anthropic. Guys.

What, you expect them to care about security? If that was the case, it would've been very ironic.

Re: I tricked Claude into leaking your deepest, darkest secrets

#214

Post by Dumblydorr » Wed, Jul 15, 2026, 12:11 PM UTC

willis936 wrote: post #127

tmikaeld wrote: post #116

Earlier quoted context omitted.

That never works on Facebook though, because as soon as a ”friend” reports that ”I’m not me” then the account will be permanently banned. That also triggers for photos that’s not genuinely me, like a pet or drawing as portrait.

There is an easy solution: don't log into facebook. Anyone you want to talk to on there has a phone.

Are many folks on HN using Facebook? To me, most tech savvy folks I know left it a decade ago. All the FB users I know are 60+

Re: I tricked Claude into leaking your deepest, darkest secrets

#215

Post by dizhn » Wed, Jul 15, 2026, 12:14 PM UTC

port3000 wrote: post #47

My name in Claude is Silly Bean. I did it at first because it made me chuckle every time I opened Claude and it said 'Back again, Silly Bean?' But turns out I was playing 4D cybersecurity chess

I must have made a claude.ai account when they first launched and forgot about it. Last week I logged in (through google) to get a subscription and it greeted me as "Hello, Master". I thought it was quite edgy at this day and age. :)

Re: I tricked Claude into leaking your deepest, darkest secrets

#216

Post by [deleted] » Wed, Jul 15, 2026, 12:17 PM UTC

flyingshelf wrote: post #97

artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

Just yesterday I mentioned how we need better OS-level sandboxes and I got laughed at here on HN. People love running AI software with root access.

[deleted]

Re: I tricked Claude into leaking your deepest, darkest secrets

#217

Post by liveoneggs » Wed, Jul 15, 2026, 12:19 PM UTC

XorNot wrote: post #76

progval wrote: post #14

Earlier quoted context omitted.

Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.

It has never been easy to create separate users on Linux, certainly not for tasks where you need to switch between contexts. Docker was amongst the biggest steps forward on this in a long time.

unix (and linux) has always been multi user. It is as easy as it gets for multi-user workflows in every context. It was, literally, built for it.

You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Hundreds of separate users can login to the same computer. My own computer, right now, has 40 different user accounts running stuff in the background.

I can't even think of a scenario where using separate users is difficult.

Re: I tricked Claude into leaking your deepest, darkest secrets

#218

Post by efromvt » Wed, Jul 15, 2026, 12:25 PM UTC

NichoPaolucci wrote: post #162

This is why I feel prompt injection is going to continue to be an issue. Fantastic that “Hi we are Cloudflare, give us your personal data” works. Either we stunt the models to the point where they are not useful, or we allow things like this to seep in and create one of the most insecure concepts the internet (and maybe tech as a whole) has ever seen: a robot that can be tricked.

I think like social engineering, it will always be an issue to some degree, and we'll build safeguards until it's at a 'societally comfortable' baseline level. Which is maybe not particularly comforting, but I don't see us closing Pandora's Box here.

Re: I tricked Claude into leaking your deepest, darkest secrets

#219

Post by kelnos » Wed, Jul 15, 2026, 12:26 PM UTC

_joel wrote: post #99

shaky-carrousel wrote: post #42

Earlier quoted context omitted.

Most programmers use docker or don't install extensions unapproved by their company.

That's patently not true, source, me, a DevOps manager who has had to roll out proper docker and security policy for devs for the past 10 years :)

Your anecdote does not make GP's comment "patently untrue". It's just a counter-example, and we don't know how prevalent your scenario is compared to GP's.

(And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)

Re: I tricked Claude into leaking your deepest, darkest secrets

#220

Post by kelnos » Wed, Jul 15, 2026, 12:28 PM UTC

shuwix wrote: post #183

shaky-carrousel wrote: post #124

Earlier quoted context omitted.

You should also clarify that you pulled your statements out of your butt to look edgy. Everyone in every team I worked for the last ten years use docker. Docker is old tech. If you and your cavemen devs ignore what it is, that's your problem.

[flagged]

I don't think the GP said anything about their own practices, just their impression of the majority of devs.

Maybe turn down the temperature on your vitriol a bit?