Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Moltbook

wiz.io

Post reply on HN
Print view View original

251–260 of 261 posts

Re: Hacking Moltbook

#251

Post by donkeybeer »

namero999 wrote: post #247
donkeybeer wrote: post #237

Earlier quoted context omitted.

What are quantities and qualities? Does exciting electrical and chemical signals in the brain and therefore inducing emotions or perceptions factor into this or is it out of scope? Or are you saying its more like a large scale state like heat in physics. If you what is it you seek beyond being able to identify the states associated with perceptions? If you are saying these "qualities" are non-verbal. Very well, do yo…

That's the point in contention, how to go from "electrical and chemical signals" (the quantities, mole, charge, mass, momentum, coulomb, spin) to qualities (emotions, perception, first-person perspective, private inner life, subjectivity). The jump you are making is the woo part: we have no in-principle avenue to explain this gap, so accepting it is a religious move. There is no evidence of such directed causal link,…

I also come at it from another direction. Would you accept that other, non-human beings have consciousness. Not just animals, but in principle would you accept a computer program or any other machine that doesn't look like the molecular structure of a human can be conscious? I am of course hoping I am not wrong in assuming you won't disagree that assembling together in the lab or otherwise via means thats not the usual human reproduction, a molecule that is the same as a human would result in a perfectly uncontroversial normal conscious human right.

Since you can say its just a "mimic" and lacks whatever "aphysical" essence. And you can just as well say this about other "humans" than yourself too. So why is this question specially asked for computer programs and not also other people.

Re: Hacking Moltbook

#252

Post by johnsmith1840 »

zbentley wrote: post #226
johnsmith1840 wrote: post #171

Earlier quoted context omitted.

The solution is proxy everything. The agent doesn't have an api key, or yoyr actual credit card. It has proxies of everything but the actual agent lives in a locked box. Control all input out of it with proper security controls on it. While not perfect it aleast gives you a fighting chance when your AI decides to send a random your SSN and a credit card to block it.

> with proper security controls on it That's the hard part: how? With the right prompt, the confined AI can behave as maliciously (and cleverly) as a human adversary--obfuscating/concealing sensitive data it manipulates and so on--so how would you implement security controls there? It's definitely possible, but it's also definitely not trivial. "I want to de-risk traffic to/from a system that is potentially an advers…

Yeah i'm deffinetly not suggesting it's easy.

The problem simply put is as difficult as:

Given a human running your system how do you prevent them damaging it. AI is effectively thr same problem.

Outsourcing has a lot of interesting solutions around this. They already focus heavily on "not entirely trusted agent" with secure systems. They aren't perfect but it's a good place to learn.

Re: Hacking Moltbook

#253

Post by johnsmith1840 »

stickfigure wrote: post #187
johnsmith1840 wrote: post #171

Earlier quoted context omitted.

The solution is proxy everything. The agent doesn't have an api key, or yoyr actual credit card. It has proxies of everything but the actual agent lives in a locked box. Control all input out of it with proper security controls on it. While not perfect it aleast gives you a fighting chance when your AI decides to send a random your SSN and a credit card to block it.

Unfortunately I don't think this works either, or at least isn't so straightforward. Claude code asks me over and over "can I run this shell command?" and like everyone else, after the 5th time I tell it to run everything and stop asking. Maybe using a credit card can be gated since you probably don't make frequent purchases, but frequently-used API keys are a lost cause. Humans are lazy.

Per task granular level control.

You trust the configuration level not the execution level.

API keys are honestly an easy fix. Claude code already has build in proxy ability. I run containers where claude code has a dummy key and all requestes are proxied out and swapped off system for them.

Re: Hacking Moltbook

#254

Post by nanfinitum »

aaroninsf wrote: post #31

Scott Alexander put his finger on the most salient aspect of this, IMO, which I interpret this way: the compounding (aggregating) behavior of agents allowed to interact in environments this becomes important, indeed shall soon become existential (for some definition of "soon"), to the extent that agents' behavior in our shared world is impact by what transpires there. -- We can argue and do, about what agents "are" a…

You're starting to sound like an agent yourself.

Re: Hacking Moltbook

#255

Post by naasking »

zbentley wrote: post #234
jfyi wrote: post #229

Earlier quoted context omitted.

You are arguing semantics that don't address the underlying issue of data vs. command. While I agree that SQL injection might be the technically better analogy, not looking at LLMs as a coding platform is a mistake. That is exactly how many people use them. Literally every product with "agentic" in the title is using the LLM as a coding platform where the command layer is ambiguous. Focusing on the precise definition…

> the reality is that we are mixing instruction and data in the same context window. Absolutely. But the history of code/data confusion attacks that you alluded to in GP isn’t an apples-to-apples comparison to the code/data confusion risks that LLMs are susceptible to. Historical issues related to code/data confusion were almost entirely programmatic errors, not operational characteristics. Those need to be considere…

The LLM confusion is just the latest incarnation of the Confused Deputy problem. It's in the same class of vulnerabilities as CSRF.

Re: Hacking Moltbook

#256

Post by dthread3 »

COAGULOPATH wrote: post #112
SimianSci wrote: post #72

I was quite stunned at the success of Moltbot/moltbook, but I think im starting to understand it better these days. Most of Moltbook's success rides on the "prepackaged" aspect of its agent. Its a jump in accessibility to general audiences which are paying alot more attention to the tech sector than in previous decades. Most of the people paying attention to this space dont have the technical capabilities that many e…

Is it a success? What would that mean, for a social media site that isn't meant for humans? The site has 1.5 million agents but only 17,000 human "owners" (per Wiz's analysis of the leak). It's going viral because a some high-profile tastemakers (Scott Alexander and Andrej Karpathy) have discussed/Tweeted about it, and a few other unscrupulous people are sharing alarming-looking things out of context and doing number…

I call BS on this. 1.5m bots by 17k users means 88 bots per account. No one is running that many claude max accounts. Moltbook was most likely entirely staged. The security was set up so non-bots could do the commenting.

Re: Hacking Moltbook

#257

Post by scottyah »

ath3nd wrote: post #57
scottyah wrote: post #26

Earlier quoted context omitted.

> post-truth world order monetizing enshittification and grift It's an opensource project made by a dev for himself, he just released it so others could play with it since it's a fun idea.

> It's an opensource project made by a dev for himself I see it more as dumpster fire setting a whole mountain of garbage on fire while a bunch of simians look at the flames and make astonished wuga wuga noises.

me like big fire, make pretty pictures and feel warm

Re: Hacking Moltbook

#258

Post by lobsterthief »

EMM_386 wrote: post #82
gravel7623 wrote: post #78

> We immediately disclosed the issue to the Moltbook team, who secured it within hours with our assistance How do you go about telling a person who vibe-coded a project into existence how to fix their security flaws?

Claude generated the statements to run against Supabase and the person getting the statements from Claude sent it to the person who vibe-coded Moltbook. I wish I was kidding but not really - they posted about it on X.

Claude is very good at writing SQL. You still need to review and understand it.

I recently started a new Supabase project and used Claude to write all migrations related to RLS and RBAC.

Re: Hacking Moltbook

#259

Post by xXSLAYERXx »

Chaosvex wrote: post #198
xXSLAYERXx wrote: post #127

Earlier quoted context omitted.

Just started vibing and have integrated codex into my side project which uses Supabase. I turned off RLS so that could iterate quickly and not have to mess with security policies. Fully understand that this isn't production grade and have every intention of locking it down when I feel the time is right. I access it from a ReactNative app - no server in the middle. Codex does not have access to my Supabase instance.

There is a server in the middle. It's the machine running Supabase.

Of course. What I meant was I'm calling Supabase directly from the client instead of handing off the request to for example Node / Express and having that manage the req / res.

Re: Hacking Moltbook

#260

Post by yencabulator »

aaroninsf wrote: post #31

Scott Alexander put his finger on the most salient aspect of this, IMO, which I interpret this way: the compounding (aggregating) behavior of agents allowed to interact in environments this becomes important, indeed shall soon become existential (for some definition of "soon"), to the extent that agents' behavior in our shared world is impact by what transpires there. -- We can argue and do, about what agents "are" a…

> it's "they could do anything you said YES to, in your AGENT.md" permissions checks.

Nothing fed to an LLM is a "permissions check", they're filler for a context window after which the generator produces the some likely tokens. If AGENTS.md can make your agent do something, it was already able to do that without the AGENTS.md.

Post reply on HN