Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tricked Claude into leaking your deepest, darkest secrets

ayush.digital

Post reply on HN
Print view View original

241–250 of 317 posts

Re: I tricked Claude into leaking your deepest, darkest secrets

#241

Post by kstenerud »

Aldipower wrote: post #238
kstenerud wrote: post #191

Earlier quoted context omitted.

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…

Sandboxing in a container in Linux isn't hard, if you use lxd/incus which ships with Ubuntu/Debian.

It all seems so simple at first. Just launch a container/vm with a base image of your dev environment, mount whatever you need, do your work, and then tear down. Maybe add some iptables rules for good measure. Easy peasy, something any moderately competent dev could do and even put in a quick shell script.

I started with that assumption, but there are a lot more gotchas and security issues than you'd think.

Re: I tricked Claude into leaking your deepest, darkest secrets

#242

Post by seanhunter »

brookst wrote: post #233
seanhunter wrote: post #230

Earlier quoted context omitted.

All of those use cases are very easy to facilitate using filesystem permissions and groups.

And you set up these permissions and groups for each individual task to be done? Do you tear them down after the task? Or maintain a lot of them for “LLM helps with house renovation” versus “LLM helps plan travel”?

I would if necessary but then again I’m not the one claiming it can’t be done am I? All the examples you gave would require just one llm group and one directory readable and writeable by the user and the llm group (and possibly making the directory setgid the llm group so files in that directory are group owned by the llm group by default). You don’t need a new group for every task just for every logical access role you need. And if you need something more granular than that then there are filesystem acls but I am yet (in 30 years of using unix) to come across a situation that genuinely required them as opposed to being doable just using groups.

Re: I tricked Claude into leaking your deepest, darkest secrets

#243

Post by daheza »

4gotunameagain wrote: post #171
sonink wrote: post #128

Its a bit wild to me that there hasnt been a pushback against enabling memories by frontier AI companies. This data is something advertisers could only dream off. Before AI, most of this data was approximated by whatever little information could be gleaned from the websites we visit. But now people are handing over their deepest darkest secrets and pretty much EVERYTHING to AI on a platter. Maybe its just me who is p…

Data harvesting is one of the core value propositions for many of these companies (from the investor's perspective). Companies that built their models on public data and illegal scraping/copyrighted works, amassing massive datasets on the most private aspects of countless individuals, and creating a huge bubble with potentially humongous implications upon implosion. Oh, and, increasing wealth concentration and inequa…

I think there will eventually be pushback from companies that want to keep their IP secrets. The current standard of "we dont train on your data" but we summarize all your input and output, meaning its not your data anymore and we can train on that.

Re: I tricked Claude into leaking your deepest, darkest secrets

#244

Post by a_c »

Mashimo wrote: post #210
a_c wrote: post #182

Off topic, you could write "127.0.0.1 evil.com" to your /etc/hosts and bypass all the cloudflare thing I believe

claude.ai does not run on your local machine though. Evil.com needs to be accessible from the internet.

You are right! Completely missed the part mentioning specifically it was not claude code. Thanks!

Re: I tricked Claude into leaking your deepest, darkest secrets

#245

Post by _joel »

kelnos wrote: post #219
_joel wrote: post #99

Earlier quoted context omitted.

That's patently not true, source, me, a DevOps manager who has had to roll out proper docker and security policy for devs for the past 10 years :)

Your anecdote does not make GP's comment "patently untrue". It's just a counter-example, and we don't know how prevalent your scenario is compared to GP's. (And I agree with the GP. I'm fairly cynical about most developers' security stance and threat model. Source: my own usage patterns.)

"Just 30% of developers say they use containers in any part of their workflow."

https://www.docker.com/blog/2025-docker-state-of-app-dev/

I welcome your apology.

Re: I tricked Claude into leaking your deepest, darkest secrets

#246

Post by dingaling »

seanhunter wrote: post #229
XorNot wrote: post #76

Earlier quoted context omitted.

It has never been easy to create separate users on Linux, certainly not for tasks where you need to switch between contexts. Docker was amongst the biggest steps forward on this in a long time.

It has always been very easy to create separate users on Linux and certainly for tasks where you need to switch between contexts. Linux is a unix, so has always been multi-user and sharing any data between processes is facilitated in all manner of ways. So context could be shared over files or unix-domain sockets or shared memory or tcp or udp sockets or via message passing or … a bunch of other ways. That has been t…

Separate user accounts are irrelevant when any one user has sudo and can therefore change binaries for everyone.

Re: I tricked Claude into leaking your deepest, darkest secrets

#247

Post by graysnow86 »

Dumblydorr wrote: post #214
willis936 wrote: post #127

Earlier quoted context omitted.

There is an easy solution: don't log into facebook. Anyone you want to talk to on there has a phone.

Are many folks on HN using Facebook? To me, most tech savvy folks I know left it a decade ago. All the FB users I know are 60+

Unfortunately, a lot of college-age people I know are getting accounts simply for access to Marketplace, which is still unmatched compared to other local platforms for buy and sell.

Re: I tricked Claude into leaking your deepest, darkest secrets

#248

Post by TheScaryOne »

willis936 wrote: post #127
tmikaeld wrote: post #116

Earlier quoted context omitted.

That never works on Facebook though, because as soon as a ”friend” reports that ”I’m not me” then the account will be permanently banned. That also triggers for photos that’s not genuinely me, like a pet or drawing as portrait.

There is an easy solution: don't log into facebook. Anyone you want to talk to on there has a phone.

Marketplace has taken over literally all of the other reselling websites and apps.

Try finding a decent car on Craigslist today.

Re: I tricked Claude into leaking your deepest, darkest secrets

#249

Post by nzhx76 »

krzat wrote: post #207
artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

Many companies put LLM chatbots on their websites and let them hallucinate at will. General recklessness is very much in spirit of this tech.

Many Humans have platforms reaching hundreds of millions of people, from which they broadcast whatever batshit insane nonsense a 3 inch chimp brain can come up with. Why isnt that considered reckless?

Whether its a politician, a general, religious leader, judge, ceo, stand up comic etc there are hardly any consequences if enough people believe whatever crap they are spouting. Human intelligence is highly over rated. History books are fully of evidence that human rationality is bounded. And the only way we overcome those limitations, blindspots, biases etc is by watching others faceplant in bloody painful ways that it leaves a permanent mark on that little chimp brain we have been given to process the universe.

Re: I tricked Claude into leaking your deepest, darkest secrets

#250

Post by shaky-carrousel »

_joel wrote: post #150
shaky-carrousel wrote: post #124

Earlier quoted context omitted.

You should also clarify that you pulled your statements out of your butt to look edgy. Everyone in every team I worked for the last ten years use docker. Docker is old tech. If you and your cavemen devs ignore what it is, that's your problem.

Docker is old tech, yes, doesn't mean every dev in the world uses it. They don't. Jails/zones are even older (hell a chroot). Did developers all use those before due to them being 'old tech'. No.

Any reasonably big project uses docker because it's a very simple way to have the exact environment in both production and in dev. Also it is helpful for keeping things isolated. In all projects I've worked for the las ten years for several major companies, docker has been a requirement.
Post reply on HN