Running Claude Code dangerously (safely) • Hacker News Board

Re: Running Claude Code dangerously (safely)

#171

Post by nikvdp » Tue, Jan 20, 2026, 5:53 PM UTC

For a similar but lighter weight (and less isolated) tool that uses the OS's sandboxing functionality (bubblewrap on linux, Seatbelt/sandbox-exec on macos) or docker check out cco [1] (note: I built it). It's primarily useful now because it can also sandbox other agents like opencode or codex since Anthropic has added native sandboxing functionality to Claude Code itself now. Their sandbox works similarly, also using bubblewrap and seatbelt, and can be accessed via the /sandbox slash command inside Claude Code [2].

[1]: https://github.com/nikvdp/cco [2]: https://code.claude.com/docs/en/sandboxing

Re: Running Claude Code dangerously (safely)

#172

Post by kaffekaka » Tue, Jan 20, 2026, 5:58 PM UTC

sixhobbits wrote: post #35

clbrmbr wrote: post #17

I have been running two or three Claude’s bare metal with dangerously skip permissions all day every day for two months now. It’s absolutely liberating.

same, it's made a couple of damaging mistakes but so far it has a better track record than me in terms of fat-fingering `rm` commands or what have you

I am sure that someday I will do something fat-fingered myself as well, but I have not in many years now. Are you saying that you make "damaging mistakes" relatively often?

Re: Running Claude Code dangerously (safely)

#173

Post by HWR_14 » Tue, Jan 20, 2026, 6:06 PM UTC

intrasight wrote: post #63

Retr0id wrote: post #57

> VirtualBox 7.2.4 shipped with a regression that causes high CPU usage on idle guests. What are the odds. I have such a love/hate relationship with VirtualBox. It's so useful but so buggy. My current installation has a bug that causes high network latency, but I'm afraid to upgrade in case it introduces new, worse bugs. VMware is a million times better, but it is also Proprietary™

As VMWare Workstation is now free on Linux and Windows, and allows you to create and rollback snapshots. Why not use it even if proprietary?

And OSX. Or the functionality is free, but the name of the client might be different

Re: Running Claude Code dangerously (safely)

#174

Post by foreigner » Tue, Jan 20, 2026, 6:15 PM UTC

RobinL wrote: post #36

Does anyone have direct experience with Claude making damaging mistakes in dangerously skip permissions mode? It'd be great to have a sense of what the real world risk is.

I caught Claude using docker (running as root) to access files on my machine it couldn't read using it's user.

Re: Running Claude Code dangerously (safely)

#175

Post by dist-epoch » Tue, Jan 20, 2026, 6:29 PM UTC

eli wrote: post #153

redactsureAI wrote: post #150

Earlier quoted context omitted.

ec2 node?

Or just a VM that doesn't share so much with your host. Just makes for a more annoying dev experience.

Why do you need to share anything? Code goes through GitHub - VM has it's own repo clone, if you need data files, you mount them read-only in the VM, have a read-write mount for output data.

Re: Running Claude Code dangerously (safely)

#176

Post by dist-epoch » Tue, Jan 20, 2026, 6:30 PM UTC

lucasluitjes wrote: post #118

> What you’re NOT protecting against: > a malicious AI trying to escape the VM (VM escape vulnerabilities exist, but they’re rare and require deliberate exploitation) No VM escape vulns necessary. A malicious AI could just add arbitrary code to your Vagrantfile and get host access the first time you run a vagrant command. If you're only worried about mistakes, Claude could decide to fix/improve something by adding a…

Another way is malicious code gets added to the repo, if you ever run the repo code outside the VM you get infected.

Re: Running Claude Code dangerously (safely)

#177

Post by rando77 » Tue, Jan 20, 2026, 6:40 PM UTC

I'm interested in capability based software, with tools to identify the lethal trifecta.

This seems like a very hard problem with coding specifically as you want unsafe content (web searches) to be able to impact sensitive things (code).

I'd love to find people to talk to about this stuff.

Re: Running Claude Code dangerously (safely)

#178

Post by snowmobile » Tue, Jan 20, 2026, 6:46 PM UTC

devolving-dev wrote: post #127

snowmobile wrote: post #121

Bit of a wider discussion, but how do you all feel about the fact that you're letting a program use your computer to do whatever it wants without you knowing? I know right now LLMs aren't overly capable, but if you'd apply this same mindset to an AGI, you'd probably very quickly have some paperclip-maximizing issues where it starts hacking into other systems or similar. It's sort of akin to running experiments on con…

Don't you have the same issue when you hire an employee and give them access to your systems? If the AI seems capable of avoiding harm and motivated to avoid harm, then the risk of giving it access is probably not greater than the expected benefit. Employees are also trying to maximize paperclips in a sense, they want to make as much money as possible. So in that sense it seems that AI is actually more aligned with m…

An AI has no concept of human life nor any morals. Sure, it may "act" like it, but trying to reason about its "motivations" is like reasoning about the motivations of smallpox. Humans want to make money, but most people only want that in order provide a stable life for their family. And they certainly wouldn't commit mass murder for a billion dollars, while an AGI is capable of that.

> So in that sense it seems that AI is actually more aligned with my goals than a potential employee.

It may seem like that but I recommend you reading up on different kinda of misalignment in AI safety.

Re: Running Claude Code dangerously (safely)

#179

Post by snowmobile » Tue, Jan 20, 2026, 6:50 PM UTC

devolving-dev wrote: post #144

johndough wrote: post #136

Earlier quoted context omitted.

I do not believe that LLMs fear punishment like human employees do.

Whether driven by fear or by their model weights or whatever, I don't think that the likelihood of an AI agent, at least the current ones like Claude and Codex, acting maliciously to harm my systems is much different than the risk of a human employee doing so. And I think this is the philosophical difference between those who embrace the agents, they view them as akin to humans, while those who sandbox them view them…

Sure, current agents are harmless, but that's due to their low capability, not due to their alignment with human goals. Can you explain why you'd view them as more similar to humans than to computer viruses?

Re: Running Claude Code dangerously (safely)

#180

Post by infamia » Tue, Jan 20, 2026, 6:51 PM UTC

If you're on a Linux or Unix OS, a chroot jail might be a more lightweight solution. the chroot command essentially makes the chrooted directory look like the root dir. You need to set up all the directories claude can access (like /usr/bin or whatever). I haven't tried this yet, but I don't see any reason it wouldn't work. This solution would protect files outside your project from getting trashed, but not malicious data exfiltration.