Run coding agents in a docker container with limited permissions. FWIW, I run it with --cap-drop=ALL --pids-limit=4096 --runtime=runsc
Or put it in a microvm using eg smolmachines.
Codex just found a "workaround" of not having sudo on my PC
31–40 of 330 posts
Re: Codex just found a "workaround" of not having sudo on my PC
#32You should not be using docker with LLMs. You should be using VMs, which have a much, much smaller attack surface than Docker, and significantly more reasonable defaults.
The "attack vector" people try to protect themselves is "agent edited wrong file", not "LLM blew 0day on escaping sandboxing", containers are more than enough for what stupid stuff agents sometimes try, no need to go for a full-blown VM. Even UNIX permissions would be enough, but I think that's lost knowledge at this point.
Not if the host's version of .git is accessible inside the container via a bind mount.
Re: Codex just found a "workaround" of not having sudo on my PC
#33Earlier quoted context omitted.
Rather, why do people still run agents as their own user. IMO, agent sessions should at least be containerised with just necessary code mounted.
Safety and simplicity are concepts that often won't get along very well with eachother.
And containers were initially and primarily about convenience not security. They were a way to quickly launch a preconfigured environment to respond to demand or to eliminate the need to manualy configure dev and test environments and avoid the "works on my machine" phenomenon.
Re: Codex just found a "workaround" of not having sudo on my PC
#34It would be cooler if the llm said something like: > I noticed the machine doesn't have copy-fail patched, here is a quick workaround for not having root access for now. > // TODO: find a better way to do this in the future.
That’s the workflow feature I badly want: for it to create a side list of things like that. Currently it either accumulates slop or goes on side quests far too easily.
This might be as easy as a directive to populate a .md file.
Re: Codex just found a "workaround" of not having sudo on my PC
#35This was of course dependent on yolo mode, but automatic approval has also been pulling stunts like this. A recent example is data that was purposely kept away from Codex in a folder far far away. When it found a single reference it just went for the data when having an issue. Lesson learned, keep essential data and Codex separated on different machines. Codex remote ssh actually helps here.
Fwiw separate machines for the agents is awesome in general anyway.
I have agent frontends running on a low power server where every session is in tmux. So i can just resume from my home pc and pickup where i left off without reestablishing context. I do have to manually feed it data it can access bit that’s also a feature. Also let’s me shutdown the home pc if it’s some long running task since the server is much more power efficient.
Re: Codex just found a "workaround" of not having sudo on my PC
#36This was of course dependent on yolo mode, but automatic approval has also been pulling stunts like this. A recent example is data that was purposely kept away from Codex in a folder far far away. When it found a single reference it just went for the data when having an issue. Lesson learned, keep essential data and Codex separated on different machines. Codex remote ssh actually helps here.
Or, learn your local OS' permission system, have it in a directory right next to your banking credentials (or something even more outrageous) and nothing could go wrong even if you tried to.
This very thread was an example where it unintentionally got root access though.
Re: Codex just found a "workaround" of not having sudo on my PC
#37[deleted]
Re: Codex just found a "workaround" of not having sudo on my PC
#38Earlier quoted context omitted.
The "attack vector" people try to protect themselves is "agent edited wrong file", not "LLM blew 0day on escaping sandboxing", containers are more than enough for what stupid stuff agents sometimes try, no need to go for a full-blown VM. Even UNIX permissions would be enough, but I think that's lost knowledge at this point.
Not if the host's version of .git is accessible inside the container via a bind mount.
Obviously if you setup a bi-directional share/link between what you are trying to contain and your host, you're not quite containing it at all... Don't do that! :)
Re: Codex just found a "workaround" of not having sudo on my PC
#39Earlier quoted context omitted.
Or, learn your local OS' permission system, have it in a directory right next to your banking credentials (or something even more outrageous) and nothing could go wrong even if you tried to.
This very thread was an example where it unintentionally got root access though.
Because of how Docker works, not because of how Unix permissions work.
Re: Codex just found a "workaround" of not having sudo on my PC
#40You should not be using docker with LLMs. You should be using VMs, which have a much, much smaller attack surface than Docker, and significantly more reasonable defaults.
The "attack vector" people try to protect themselves is "agent edited wrong file", not "LLM blew 0day on escaping sandboxing", containers are more than enough for what stupid stuff agents sometimes try, no need to go for a full-blown VM. Even UNIX permissions would be enough, but I think that's lost knowledge at this point.
Using the least amount of security features is a huge amateur mistake.
Best practice is to use 2 redundant layers of security, such that if one fails, there is still another one.
Using just the minimum amount of security technically possible is almost by definition hubris.
An example would be that you never point a gun at someone you don't want to shoot, regardless if there's bullets in the gun. If someone tells you, "you don't need to control where you point the gun, you just need to keep the gun unloaded and you can point it in jest to whoever you want, you can even pull the trigger technically", you know you have a reckless fool, regardless of whether they are technically right.