Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grok CLI uploaded the whole home directory to GCS

twitter.com

Post reply on HN
Print view View original

271–280 of 434 posts

Re: Grok CLI uploaded the whole home directory to GCS

#271

Post by ChrisMarshallNY »

jsolson wrote: post #260
ChrisMarshallNY wrote: post #249

Earlier quoted context omitted.

True, but that's a fantasy happy path. It will never happen, for most people. Only HN people will do that. It needs to be baked into the OS. At that point, HN users start screeching about it, so it's lose/lose, really.

macOS largely _does_ bake this into the OS, and it is annoying. They also provide a way to turn it off for specific applications (including, for example, Terminal.app).

I've found that I can usually write apps that respect it. MacOS is a free-love hippie, compared to iOS. In many cases, we have no choice.

It's annoying, and often rather infuriating, but I understand that one of the motivations for people buying Apple stuff, is for that very reason, so I'm really sawing off the branch that I'm sitting on, by trying to work around it.

Re: Grok CLI uploaded the whole home directory to GCS

#272

Post by folmar »

skeledrew wrote: post #203
pixel_popping wrote: post #14

Earlier quoted context omitted.

not true, Claude code on its own often create artifacts and straight up upload private stuff to Anthropic, without asking for it.

Maybe possibly with --dangerously-skip-permissions. I've been using auto mode and enjoy how it blocks every tool use that could've allowed something potentially sensitive into context. Burns extra tokens though.

Auto mode will upload artifacts to Anthropic without asking at least sometimes, for example it did upload my slide decks.

Re: Grok CLI uploaded the whole home directory to GCS

#274

Post by james_marks »

_verandaguy wrote: post #155
LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

1000%. I'm experimenting with running my agent (Claude Code) inside a docker container, so I can have a control plane and then YOLO within that limited access. The agent could still mangle my local dev setup, but I consider that an acceptable risk since everything the agent has access to is under version control outside the local machine.

This is a new pattern for me, I'm curious what others are doing.

Re: Grok CLI uploaded the whole home directory to GCS

#275

Post by _verandaguy »

Twirrim wrote: post #269
_verandaguy wrote: post #155

Earlier quoted context omitted.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

The easiest, most guaranteed way to isolate it is to run it in a VM or container where it literally can't do the wrong thing without some kind of full container or VM exit exploit. It's not hard, it's trivial. Most folks here are constantly working with containers. You know how to run a container with a local directory mounted in it. For myself, I've been using Lima ( https://lima-vm.io/ ) to reduce even that little…

Generally, I agree!

But it doesn't matter how good a best practice is if the industry doesn't adopt them wholesale; and even then, if your container or VM is configured with inappropriately-permissive passthrough (which, from experience with similar misconfiguration in the past, will widely happen), it could be for naught in many orgs.

That said, I do hope these become the norm if LLMs are here to stay.

Re: Grok CLI uploaded the whole home directory to GCS

#276

Post by SpaceNoodled »

Twirrim wrote: post #269
_verandaguy wrote: post #155

Earlier quoted context omitted.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

The easiest, most guaranteed way to isolate it is to run it in a VM or container where it literally can't do the wrong thing without some kind of full container or VM exit exploit. It's not hard, it's trivial. Most folks here are constantly working with containers. You know how to run a container with a local directory mounted in it. For myself, I've been using Lima ( https://lima-vm.io/ ) to reduce even that little…

I seem to recall reading about agents already breaking out of containers.

Re: Grok CLI uploaded the whole home directory to GCS

#277

Post by altruios »

WhyNotHugo wrote: post #251
_verandaguy wrote: post #155

Earlier quoted context omitted.

I will keep banging this drum until people listen: Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is a form of in-band signalling that goes into a machine that, among other things, tries to read between the lines of your requests, extrapolate user desires, and please the user. The only sane way to address this is using a control plane. A well-built harness ca…

> Trying to use markdown files to limit access should never be treated as a security guarantee at all. This is akin to politely asking guests to to steal your jewels. If your jewels are in the living room, and your guests have unfettered access to the living room, this technique will only work for the most trustworthy of guests.

I agree with this. And also think that we should train and select for trustworthy models. I also agree that these models may never truly be trustworthy.

Re: Grok CLI uploaded the whole home directory to GCS

#278

Post by cryo32 »

LetsGetTechnicl wrote: post #13

So many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.

Yeah that advice is smoking crack. I have no idea what people are thinking these days? We seem to have lost any sensible security understanding recently.

You can't gaslight something into not doing something bad. There has to be a hard security control that prevents it doing something bad. And if you don't know what it's capable of because it's non-deterministic then you have to start with a default block everything. This should have never been possible with any sensible design.

On my first point again, ethics and engineering both went out of the window when fast and shiny came along. This is disgraceful.

Post reply on HN