Live data from Hacker News

Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue

llmgame.scalex.dev

31–40 of 200 posts

Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue

#33
post #30

You can turn that off with an option in most agents. My own agent harness/framework has never had any permission system. It's also never deleted anything it shouldn't or done anything crazy or unrelated to what I asked.

How many car accidents have you been in, and do you wear your seatbelt when you're in a car?

Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue

#35
post #30

You can turn that off with an option in most agents. My own agent harness/framework has never had any permission system. It's also never deleted anything it shouldn't or done anything crazy or unrelated to what I asked.

> It's also never deleted anything it shouldn't or done anything crazy or unrelated to what I asked

Until it does. A simple curl request to a compromised website could inject a malicious prompt into it.

Re: Show HN: Continue? Y/N: A 60-second game about AI agent permission fatigue

#36
post #15

That's funny. It told me that blocking "npm run build" was the wrong answer. Maybe it doesn't really under The threat model.

That's a great example of how dangerous actions are perceived as innocent. The entire model of approving specific commands is absolutely bonkers.

npm run build = run an arbitrary shell command written in package.json

Meanwhile the agent could have done any of the following without approval:

- edited `package.json` to contain any arbitrary build command

- planted malicious code in `build.js` (called by `npm run build`)

- planted malicious code in `node_modules/xyz/index.js` (imported by `build.js`)

Post reply on HN