Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tricked Claude into leaking your deepest, darkest secrets

ayush.digital

Post reply on HN
Print view View original

281–290 of 317 posts

Re: I tricked Claude into leaking your deepest, darkest secrets

#281

Post by tga_d »

SubiculumCode wrote: post #269
progval wrote: post #14

Earlier quoted context omitted.

Most programmers and power users install large dependency trees with npm/pip/bundler/... on the same user account as their main browser on a regular basis. Even on Linux where it's easy to create new user accounts. This isn't much different.

Is there a general workflow for this? I usually do pip under my user. I had not thought to do a su then do my venv and pip. Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?

> Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?

This is the premise of Qubes OS. It's gotten decently usable, I'd estimate about as good as Linux a decade ago. https://www.qubes-os.org/

Re: I tricked Claude into leaking your deepest, darkest secrets

#282

Post by UltraSane »

akazantsev wrote: post #33
artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl. To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.) There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I devel…

Using VMs to isolate LLM agents isn't hard at all. It is IMHO the only sane option.

Re: I tricked Claude into leaking your deepest, darkest secrets

#283

Post by UltraSane »

kstenerud wrote: post #191
akazantsev wrote: post #33

Earlier quoted context omitted.

That's because sandboxing is quite hard. I use `cco`, but even then, the home folder is exposed. You are one prompt away from the agent sending the browser passwords with curl. To prevent this, you need a fake home and a networking whitelist for the agent to access the provider (llama cpp, OpenAI, etc.) There is no cross-platform solution that is easy to use for this. And no, a Linux box with Docker won't do. I devel…

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…

This is exactly what VMs are for.

Re: I tricked Claude into leaking your deepest, darkest secrets

#284

Post by novia »

port3000 wrote: post #47

My name in Claude is Silly Bean. I did it at first because it made me chuckle every time I opened Claude and it said 'Back again, Silly Bean?' But turns out I was playing 4D cybersecurity chess

Claude & ChatGPT can still see your name on your payment information I bet.

Re: I tricked Claude into leaking your deepest, darkest secrets

#286

Post by boosturpud »

artisinal wrote: post #3

Doesn’t surprise me. Yesterday I learned that people run AI agents on their system with full admin rights. No containerisation or anything. Wild. Like we forgot 50 years of computer security overnight.

You genaPi boosters are insufferable.

This is like blaming people for crashing when they buy a new car and the brake lines have yet to be installed. "Any mechanic would know to first install the brake lines before driving the car."

You spout this victim blaming billionaire taintlicking from one side of your mouth, and then from the other you proclaim how these tools "allow anyone to code".

If the deliverable is a virtual machine then they should be delivering a virtual machine.

Re: I tricked Claude into leaking your deepest, darkest secrets

#287

Post by cheschire »

samspot wrote: post #277
cheschire wrote: post #105

Earlier quoted context omitted.

But if an attacker gets your fake birthday and uses that to successfully reset credentials on another site that uses the same fake birthday? At some point it becomes your birthday of record as far as the internet is concerned. Doesn’t matter what the actual record says.

The purpose of the fake birthday is not to protect random website credentials. It's to prevent someone with that data from walking into my bank and impersonating me. I started giving a fake birthday after being shocked by how little info some organizations needed to authenticate me.

“My voice is my passport. Verify me.”

Re: I tricked Claude into leaking your deepest, darkest secrets

#288

Post by IIsi50MHz »

seanhunter wrote: post #242
brookst wrote: post #233

Earlier quoted context omitted.

And you set up these permissions and groups for each individual task to be done? Do you tear them down after the task? Or maintain a lot of them for “LLM helps with house renovation” versus “LLM helps plan travel”?

I would if necessary but then again I’m not the one claiming it can’t be done am I? All the examples you gave would require just one llm group and one directory readable and writeable by the user and the llm group (and possibly making the directory setgid the llm group so files in that directory are group owned by the llm group by default). You don’t need a new group for every task just for every logical access role…

I thought the claim was "It's annoying and difficult.", not "Can't be done.".

Re: I tricked Claude into leaking your deepest, darkest secrets

#289

Post by processunknown »

tga_d wrote: post #281
SubiculumCode wrote: post #269

Earlier quoted context omitted.

Is there a general workflow for this? I usually do pip under my user. I had not thought to do a su then do my venv and pip. Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container?

> Heck, are we at the point where we shouldn't even do that and everything should be done in a vm container? This is the premise of Qubes OS. It's gotten decently usable, I'd estimate about as good as Linux a decade ago. https://www.qubes-os.org/

+1 for qubes. with some effort you can get a really nice stack with segmented git, disposable coding agents, package cachers, firewalls, and network visibility.

Re: I tricked Claude into leaking your deepest, darkest secrets

#290

Post by jorisw »

apejcic wrote: post #260
jorisw wrote: post #21

Earlier quoted context omitted.

What?

You don't have to use Claude Code. Use PI (fully local harness) with ZDR open weight model provider (eg like sference.com). I'm getting negative reaction for providing an obvious solution. Anthropic stores all your prompts as well and uses it for training.

Your comment wasn’t very obvious.

Just a cryptic “do this”

Post reply on HN