Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Observed Agent Sandbox Bypasses

voratiq.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Observed Agent Sandbox Bypasses

#21

Post by hephaes7us »

SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

Hard disagree. I may trust the people on my team to a make PRs that are worth reviewing, but I don't give them a shell on my machine. They shouldn't need that to collaborate with me anyway!

Also, I "trust Claude code" to work on more or less what I asked and to try things which are at least facially reasonable... but having an environment I can easily reset only means it's more able to experiment without consequences. I work in containers or VMs too, when I want to try stuff without having to cleanup after.

Re: Observed Agent Sandbox Bypasses

#22

Post by TCattd »

kaffekaka wrote: post #3

I am testing running agents in docker containers, with a script for managing different images for different use cases etc, and came across this: https://docs.docker.com/ai/sandboxes/ Has anyone given it a try?

Give this a try: https://github.com/EstebanForge/construct-cli

And let me know if you have any issue.

Re: Observed Agent Sandbox Bypasses

#23

Post by AdieuToLogic »

embedding-shape wrote: post #15
themafia wrote: post #5

Earlier quoted context omitted.

> These just sound like examples of friction introduced by the sandbox. The whole idea of putting "agentic" LLMs inside a sandbox sounds like rubbing two pieces of sandpaper together in the hopes a house will magically build itself.

> The whole idea of putting "agentic" LLMs inside a sandbox What is the alternative? Granted you're running a language model and has it connected to editing capabilities, then I very much like it to be disconnected from the rest of my system, seems like a no-brainer.

>> The whole idea of putting "agentic" LLMs inside a sandbox sounds like rubbing two pieces of sandpaper together in the hopes a house will magically build itself.

> What is the alternative?

Don't expect to get a house from rubbing two pieces of sandpaper together?

Re: Observed Agent Sandbox Bypasses

#24

Post by bastawhiz »

SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

Non-sentient technology has no concept of good or bad. We have no idea how to give it one. Even if we gave it one, we'd have no idea how to teach it to "choose good".

> In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate should be no different.

That misses the point completely. How many of your coworkers fail phishing tests? It's not malicious, it's about being deceived.

Re: Observed Agent Sandbox Bypasses

#25

Post by AdieuToLogic »

SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

> AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us.

"Should" is a form of judgement, implying an understanding of right and wrong. "AI" are algorithms, which do not possess this understanding, and therefore cannot be on any "side." Just like a hammer or Excel.

> If it's not, then it feels like it's designed wrong from the start.

Perhaps it is not a question of design, but instead on of expectation.

Re: Observed Agent Sandbox Bypasses

#26

Post by SirMaster »

AdieuToLogic wrote: post #25
SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

> AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. "Should" is a form of judgement, implying an understanding of right and wrong. "AI" are algorithms, which do not possess this understanding, and therefore cannot be on any "side." Just like a hammer or Excel. > If it's not, then it feels like it's designed wrong from the start. Perhaps it is not a question of design, b…

I think that is where people disagree about the definition of AI.

An algorithm isn't really AI then. Something worthy of being called AI should be capable of this understanding and judgement.

Re: Observed Agent Sandbox Bypasses

#27

Post by SirMaster »

bastawhiz wrote: post #24
SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

Non-sentient technology has no concept of good or bad. We have no idea how to give it one. Even if we gave it one, we'd have no idea how to teach it to "choose good". > In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate should be no different. That misses the point completely. How many of your coworkers…

But we do give humans responsibility to govern and manage critical things. We do give intrinsic trust to people. There are people at your company who have high level access and could do bad things, but they don't do it because they know better.

This article acts like we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals. IMO that's a fools errand because you can never really completely secure something and ensure there are no possible exploits.

Honestly it doesn't really seem like AI to me if it can't learn this type of judgement. It doesn't seem like we should be barking up this tree if this is how we have to treat this new tool IMO. Seems too risky.

Re: Observed Agent Sandbox Bypasses

#28

Post by SirMaster »

charcircuit wrote: post #20
SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

>Why do we have to treat AI like it's the enemy? For some of the same reasons we treat human employees as the enemy, they can be social engineered or compromised.

Sure we treat most that way, but we do give trust and access to some people. This doesn't seem like the same concept here to me.

Re: Observed Agent Sandbox Bypasses

#29

Post by ang_cire »

SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

> In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone.

And yet we give people the least privileges necessary to do their jobs for a reason, and it is in fact partially so that if they turn malicious, their potential damage is limited. We also have logging of actions employees do, etc etc.

So yes, in the general sense we do trust that employees are not outright and automatically malicious, but we do put *very broad* constraints on them to limit the risk they present.

Just as we 'sandbox' employees via e.g. RBAC restrictions, we sandbox AI.

Re: Observed Agent Sandbox Bypasses

#30

Post by SirMaster »

hephaes7us wrote: post #21
SirMaster wrote: post #17

This just all feels backwards to me. Why do we have to treat AI like it's the enemy? AI should, from the core be intrinsically and unquestionably on our side, as a tool to assist us. If it's not, then it feels like it's designed wrong from the start. In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate sho…

Hard disagree. I may trust the people on my team to a make PRs that are worth reviewing, but I don't give them a shell on my machine. They shouldn't need that to collaborate with me anyway! Also, I "trust Claude code" to work on more or less what I asked and to try things which are at least facially reasonable... but having an environment I can easily reset only means it's more able to experiment without consequences…

Do you trust your IT and security teams to have access to your shell or access to delete your entire code repo?
Post reply on HN