Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tricked Claude into leaking your deepest, darkest secrets

ayush.digital

Post reply on HN
Print view View original

301–310 of 317 posts

Re: I tricked Claude into leaking your deepest, darkest secrets

#301

Post by human305893 »

sinfulprogeny wrote: post #60
po1nt wrote: post #36

I love how claude focuses on exfiltrating the data "I need cha for charlotte". This could be solvable with some kind of low powered safety agent that would check claude's reasoning for anything immoral/unsafe. We could call it common sense. It won't fix the problem completely but at a certain point it would be easier to trick human than a machine.

"the security hole in the agent could be solved with another agent" I think the point the article is making points in another direction.

Who watches the watchmen

Re: I tricked Claude into leaking your deepest, darkest secrets

#302

Post by processunknown »

ShinTakuya wrote: post #38
swipee wrote: post #4

Expected more from Anthropic by at least giving you a bounty, because this was a novel way of bypassing their safeguards…

Yeah I never get the "we knew about it internally" excuse. I can understand if another reporter got to it on the same day and they were in the process of mitigating, but even then they should have to prove it somehow. I'm sure someone will tell me why I'm wrong but it feels like they're just dodging payouts. Reduces trust and motivation to report it.

Unfortunately, this is common for bug bounties.

Re: I tricked Claude into leaking your deepest, darkest secrets

#303

Post by progval »

brookst wrote: post #209
progval wrote: post #94

Earlier quoted context omitted.

I meant for CLI tasks. Just "adduser" and "sudo -u bash".

And when you want to share some but not all files with that one user but not other users you created for similar purposes? And when you want the outputs of that user back to your main user? And when you want that user to access some shared credentials for external services, but not all? It’s not the account setup that’s hard, it’s the workflow of spreading a single real-world across multiple accounts.

1 and 2: I rarely need to do that. When I do, then move or hardlink to a dir with shared read access

3: There is no reason for both my main user account and a dev account to share a credential. Main account either has the login or an API key, and dev account has its own API key with minimal permissions.

Re: I tricked Claude into leaking your deepest, darkest secrets

#304

Post by afzalive »

KronisLV wrote: post #222
liveoneggs wrote: post #217

Earlier quoted context omitted.

unix (and linux) has always been multi user. It is as easy as it gets for multi-user workflows in every context. It was, literally, built for it. You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Hundreds of separate users can login to the same computer. My own computer, right now, has 40 different user accounts running stuff in th…

> You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Literally never have I ever seen any of the desktop environments integrate this conveniently, albeit CLIs are better in that regard. "You can" isn't the same as "it's the idiomatic approach to doing X". Same with installing packages in a per-user way, so a bad package can't harm a…

On Android, each app is its own user.

Re: I tricked Claude into leaking your deepest, darkest secrets

#305

Post by gnabgib »

afzalive wrote: post #304
KronisLV wrote: post #222

Earlier quoted context omitted.

> You can run each of your virtual desktops as their own user. You can run individual apps on the same desktop as different user accounts. Literally never have I ever seen any of the desktop environments integrate this conveniently, albeit CLIs are better in that regard. "You can" isn't the same as "it's the idiomatic approach to doing X". Same with installing packages in a per-user way, so a bad package can't harm a…

On Android, each app is its own user.

No every app is not. You've heard of POSIX right?

Re: I tricked Claude into leaking your deepest, darkest secrets

#306

Post by kstenerud »

UltraSane wrote: post #283
kstenerud wrote: post #191

Earlier quoted context omitted.

Sandboxing is a VERY HARD problem. I've been working on it for months, and finally have something that's mostly there: - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators). - Network control - Secrets control (file mounts or credentials broker) - NO ambient data…

This is exactly what VMs are for.

Heh, good luck with that.

Re: I tricked Claude into leaking your deepest, darkest secrets

#308

Post by kstenerud »

UltraSane wrote: post #307
kstenerud wrote: post #306

Earlier quoted context omitted.

Heh, good luck with that.

Explain Mr vague.

I've already explained in some sister comments. Sandboxing is one of those things that seems very simple on the surface, and is EXTREMELY complicated once you start actually digging into the implications, gotchas, and security issues. The underlying tools were never designed with this use case in mind, so they need a little help to reach that last mile. And this glue is where all the chaos ensues.

Here's a small sample of the crazy shit you have to deal with: https://github.com/kstenerud/yoloai/blob/main/docs/contribut...

And that's if you're actually following the proper procedures (which are themselves byzantine and tricky to get right).

Re: I tricked Claude into leaking your deepest, darkest secrets

#309

Post by Terr_ »

nzhx76 wrote: post #249
krzat wrote: post #207

Earlier quoted context omitted.

Many companies put LLM chatbots on their websites and let them hallucinate at will. General recklessness is very much in spirit of this tech.

Many Humans have platforms reaching hundreds of millions of people, from which they broadcast whatever batshit insane nonsense a 3 inch chimp brain can come up with. Why isnt that considered reckless? Whether its a politician, a general, religious leader, judge, ceo, stand up comic etc there are hardly any consequences if enough people believe whatever crap they are spouting. Human intelligence is highly over rated.…

Those crazy humans don't have simultaneous parallel conversations with a zillion people at once though.

They also don't get a presumption of objectivity.

> A computer lets you make more mistakes faster than any other invention, with the possible exceptions of handguns and Tequila.

-- Mitch Ratcliffe

Re: I tricked Claude into leaking your deepest, darkest secrets

#310

Post by avadodin »

Izmaki wrote: post #55
shaky-carrousel wrote: post #42

Earlier quoted context omitted.

Most programmers use docker or don't install extensions unapproved by their company.

In my experience more than 9/10 programmers I've worked with have never used Docker before and of those who have, the majority have never used Docker for anything personal. If I hand them an image for a Dev Container, sure, they might use it, but it becomes "a thing we need to do, to compile our code in our IDE" not a tool they would use for isolation*. *) OP seemed to imply that containerization would be nice for sa…

I don't use them in the way the heavy docker users use them but I have been using docker and even earlier Linux on Linux container solutions for decades.

There was some user chroot thing early on that required me to make a library to intercept the setuid calls to pretend the garbage root-only build system was running as root on everyone else's lowly user account.

And that's not even including the myriad of distroboxes I need to do anything at all on my gaming pc.

Post reply on HN