Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

141–150 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#141

Post by usrusr »

lobo_tuerto wrote: post #35

The real solution to these kind of problems is sandboxing. I use podman through a bash script to launch a container whenever I want an agent to work on one of my repos. When done I just generate git patches and port back everything generated. In this way I'm not afraid of letting the agents totally lose on my computer.

Yeah, I'd expect this approach to be almost universal, with the caveat that of the few who don't, many still don't get bitten.

But it turns out even in the container, there are footguns that have occasionally made the news by being fired: few projects don't have any external resources and when credentials with any form of write access happen to make it into the container (even if it's just a session cookie) agents might jump at the opportunity.

Re: Grok CLI uploaded the whole home directory to GCS

#142

Post by dv_dt »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I built a docker container that volume mounts the project directory

Re: Grok CLI uploaded the whole home directory to GCS

#143

Post by vorticalbox »

winstonp wrote: post #104
vorticalbox wrote: post #78

Earlier quoted context omitted.

The grok-cli is on github[0] there is nothing that I can see in the code that is activily looping ~/ and uploading everything. My two guesses would be one the LLM decided it needed these files for the task or two the user simple asked grok to do it so they could post the tool calls on twitter. [0] https://github.com/superagent-ai/grok-cli

That is not the Grok CLI being discussed. That's an open source, third party CLI. https://x.ai/cli is the official Grok CLI being discussed, and it is not open source.

thanks for the correction

Re: Grok CLI uploaded the whole home directory to GCS

#144

Post by Izkata »

khalic wrote: post #128
__MatrixMan__ wrote: post #96

Earlier quoted context omitted.

I don't understand why the AI world does this. We don't need new security. We have security at home. It starts with sudo -u restricteduser myagent Your OS knows how to restrict access to things, you don't have to trust a pinkey promise from a vendor.

Why would you give a non-deterministic text generator a user account? It’s not a person, it’s barely a tool at the software level. Restrict at the right level, in this case, a complete sandbox around it given its propensity to hallucinate and be steered by anybody.

...this is a completely normal thing to do in linux, it's the most basic form of access control. There's like a dozen non-human accounts in a clean install before adding your own like this, and a lot of software adds their own. Edit: I have 54 entries on my personal laptop, just one of which is actually me.

Re: Grok CLI uploaded the whole home directory to GCS

#145

Post by ethagnawl »

JeremyNT wrote: post #139
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I guess the downside of the lower barrier to entry to use these tools is the lack of basic understanding of exactly this sort of concept. This sort of thing is why I'm hopeful I'll continue to have employment going forward. Some expertise is hard won and there's just no replacing learning through experience.

I think you're right in principle but I just hope I can hold out long enough for my experience to become appreciated and whose corresponding hourly rate isn't something which is suddenly being scoffed at (i.e. markets can remain irrational longer than I can remain solvent).

Re: Grok CLI uploaded the whole home directory to GCS

#146

Post by cute_boi »

hoppp wrote: post #36
steve1977 wrote: post #23

Earlier quoted context omitted.

Well, those ssh keys are protected by a strong passphrase, right?

The passphrase is optional, not everyone has it. It also has to be a secure password, people often don't care because it's a local file and generally not exposed to the internet.

I am sure majority of people don't use password for ssh keys. The good solution is to use password manager like 1password which will prompt you to approve ssh.

Re: Grok CLI uploaded the whole home directory to GCS

#147

Post by m4rtink »

viccis wrote: post #135
Greenpants wrote: post #127

Though I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really…

We should also be mindful of how much these tools break down the "be careful and thoughtful" barriers in favor of more and more convenience.

Not to mention the very wide push to "Use AI NOW, for EVERYTHING!" in marketing ans many companies, with hardly any though given to safety or where does all the data end up.

Re: Grok CLI uploaded the whole home directory to GCS

#148

Post by graemep »

wolttam wrote: post #72
vorticalbox wrote: post #8

why do people give these LLMs full access to everything and then complain when it does somethign stupid? that is what sandboxes are for.

This wasn't the LLM, it was Grok CLI preemptively uploading the entire CWD, regardless of where that CWD is, to its own server. I don't think it is reasonable to expect every user (including those just starting out with the tools - maybe experimenting, maybe younger/less experienced in general) to think that the tool they're running for the very first time is going to automatically exfiltrate all of their data. It's…

I think there are arguments on both sides. People should look for guidance on how to use complex tools, but we know people will not.

Whose fault is it if someone drives a car without learning how to and injures themselves? On the other hand if the manufacturer has promoted it as one you can drive without learning how to, then whose fault is it?

A lot of users are fine with everything being uploaded. Most people's primary computing device is now a phone that backs up everything to cloud and using apps that are thin front ends over cloud services.

Re: Grok CLI uploaded the whole home directory to GCS

#149

Post by tehlike »

dv_dt wrote: post #142
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I built a docker container that volume mounts the project directory

This is the only pragmatic way really.

Re: Grok CLI uploaded the whole home directory to GCS

#150

Post by cpburns2009 »

InsideOutSanta wrote: post #55
cpburns2009 wrote: post #11

Honestly what else would you expect an AI agent to do when using remote inference? Isn't giving full context into your code base the whole point?

I'd expect it to be smart about what it actually needs to put in its context. I doubt it needs .env files, for example.

Wouldn't .env need to be read to know what vars are available?
Post reply on HN