Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go hard on agents, not on your filesystem

jai.scs.stanford.edu

Post reply on HN
Print view View original

231–240 of 374 posts

Re: Go hard on agents, not on your filesystem

#231

Post by d1sxeyes »

oefrha wrote: post #230
cogogo wrote: post #224

Earlier quoted context omitted.

This is terrifying. I have not used agents because I do not have a sandbox machine I do not care about. Am I crazy to worry about a sandboxed agent running on my home network? Anyone experienced anything weird by doing that?

Don’t dangerously skip permissions and actually read commands when you get prompted and you’re fine.

Yeah, I actually have both an alias for `rm` and a custom seatbelt sandbox which means the agent can only delete stuff within the directory it’s working in, so wasn’t an issue, was just fun to watch it say “hm, that doesn’t seem to work. Looks like the user has aliased rm. I’ll just go ahead and work around it”

Re: Go hard on agents, not on your filesystem

#232

Post by adi_kurian »

mazieres wrote: post #65
ray_v wrote: post #41

I'm wondering if the obvious (and stated) fact that the site was vibe-coded - detracts from the fact that this tool was hand written. > jai itself was hand implemented by a Stanford computer science professor with decades of C++ and Unix/linux experience. ( https://jai.scs.stanford.edu/faq.html#was-jai-written-by-an-... )

Human author here. The fact that I don't know web design shouldn't detract from my expertise in operating systems. I wrote the software and the man page, and those are what really matter for security. The web site is... let's say not in a million years what I would have imagined for a little CLI sandboxing tool. I literally laughed out loud when claude pooped it out, but decided to keep, in part ironically but also s…

I think it will, in the modern AI slop era, look more legitimate when the web UI looks a) hand rolled and b) like not much time was spent on it at all. Which makes me a tad embarassed as someone who used to sell fancy websites for a living.

Re: Go hard on agents, not on your filesystem

#235

Post by globular-toast »

user34283 wrote: post #204
globular-toast wrote: post #187

Earlier quoted context omitted.

Erm, no, that's not a sandbox, it's an annoyance that just makes you click "yes" before you thoughtlessly extend the boundaries. A real sandbox doesn't even give the software inside an option to extend it. You build the sandbox knowing exactly what you need because you understand what you're doing, being a software developer and all.

I know 'exactly' that I will need internet for research as well as installing dependencies. And I imagine it's going to be the same for most developers out there, thus the "ask for permission" model. That model seems to work quite well for millions of developers.

If you know then why do you need to be asked? A sandbox includes what you know you need in it, no more, no less.

Re: Go hard on agents, not on your filesystem

#236

Post by greenchair »

globular-toast wrote: post #154
AnotherGoodName wrote: post #15

Add this to .claude/settings.json: { "sandbox": { "enabled": true, "filesystem": { "allowRead": ["."], "denyRead": ["~/"], "allowWrite": ["."], "denyWrite": ["/"] } } } You can change the read part if you're ok with it reading outside. This feature was only added 10 days ago fwiw but it's great and pretty much this.

And you'd trust that given CC is a vibe-coded mess? Editing to go even further because, I gotta say, this is a low point for HN. Here's a post with a real security tool and the top comment is basically "nah, just trust the software to sandbox itself". I feel like IQ has taken a complete nosedive in the past year or so. I guess people are already forgetting how to think? Really sad to see.

IQ also going down due to bot spam.

Re: Go hard on agents, not on your filesystem

#237

Post by nananana9 »

giancarlostoro wrote: post #95
mazieres wrote: post #57

Earlier quoted context omitted.

I've seen claude get confused about what directory it's in. And of course I've seen claude run rm -rf *. Fortunately not both at the same time for me, but not hard to imagine. The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches. Also, claude itself is an enormous program that is mostly developed by AI. So to have…

In my opinion Claude should be shipped by a custom implementation of "rm" that Anthropic can add guardrails to. Same with "find" surprised they don't just embed ripgrep (what VS Code does). It's really surprising they don't just tweak what Claude uses and lock it down to where it cannot be harmful. Ensure it only ever calls tooling Claude Code provides.

Oh, rm failed, since we're running in a weird environment! Let me retry with `bash -c "/usr/bin/rm -rf *"`!

Re: Go hard on agents, not on your filesystem

#238

Post by greenchair »

imtringued wrote: post #217
user34283 wrote: post #165

Earlier quoted context omitted.

Coding agents work just fine without a sandbox. If you do use a sandbox, be prepared to endlessly click "Approve" as the tool struggles to install python packages to the right location.

I've never been annoyed by the tool asking for approval. I'm more annoyed by the fact that there is an option that gives permanent approval right next to the button I need to click over and over again. This landmine means I constantly have to be vigilant to not press the wrong button.

maybe this could be a config setting.

Re: Go hard on agents, not on your filesystem

#239

Post by Game_Ender »

Where is the network isolation? I want to be able to be able to limit what external resources the agent can access and also inject secrets at request time so the agent does have access to them.

File system isolation is easy now, it’s not worth HN front page space for the n’th version. It’s a solved problem (and now included in Claude clCode).

Re: Go hard on agents, not on your filesystem

#240

Post by puttycat »

puttycat wrote: post #75

I am still amazed that people so easily accepted installing these agents on private machines. We've been securing our systems in all ways possible for decades and then one day just said: oh hello unpredictable, unreliable, Turing-complete software that can exfiltrate and corrupt data in infinite unknown ways -- here's the keys, go wild.

Forgot to mention the craziness of trusting an AI software company with your private AI codebase (think Uber's abuse of ride data).
Post reply on HN