Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go hard on agents, not on your filesystem

jai.scs.stanford.edu

Post reply on HN
Print view View original

341–350 of 374 posts

Re: Go hard on agents, not on your filesystem

#341

Post by dolmen »

lemontheme wrote: post #266
faeyanpiraat wrote: post #173

Earlier quoted context omitted.

I've just switched to lima, and cant find anything about "nono" can you post a link?

I really like lima too. It's my go-to recommendation for light VMs. But I do consider it slightly less convenient. A good example of why is project-local .venv/ directories, which are the default with uv. With Lima, what happens is that macOS package builds get mounted into a Linux system, with potential incompatibility issues. Run uv sync inside the VM and now things are invalid on the macOS side. I wasn't able to f…

So your shared .venv is the vector for the agent to escape the sandbox.

Re: Go hard on agents, not on your filesystem

#343

Post by wpaladin »

I use a custom container image which bind mounts the current working directory, and has some popular coding agents preinstalled. There's also a firewall option, with a whitelist of hosts and IP addresses that the user can modify without having to rebuild the image.

https://github.com/ambarh/agent-silo

Re: Go hard on agents, not on your filesystem

#344

Post by ray_v »

mazieres wrote: post #65
ray_v wrote: post #41

I'm wondering if the obvious (and stated) fact that the site was vibe-coded - detracts from the fact that this tool was hand written. > jai itself was hand implemented by a Stanford computer science professor with decades of C++ and Unix/linux experience. ( https://jai.scs.stanford.edu/faq.html#was-jai-written-by-an-... )

Human author here. The fact that I don't know web design shouldn't detract from my expertise in operating systems. I wrote the software and the man page, and those are what really matter for security. The web site is... let's say not in a million years what I would have imagined for a little CLI sandboxing tool. I literally laughed out loud when claude pooped it out, but decided to keep, in part ironically but also s…

I think most people in this space are having the same EXACT same sets of dilemmas - you can EASILY have a flashy website, except that it's totally against the previous norms for things like you've written! A plain-text bare-bones website is typically what a tool like this is presented with - instead of a flashy looking promotional website that's visually appealing and has all the accessibility and proper UI/UX, etc.

We've truly entered a new, better era of the Internet (IMHO).

Also, thank you for this tool - it looks like a great piece of software!

Re: Go hard on agents, not on your filesystem

#345

Post by jmalicki »

lxgr wrote: post #226
safety1st wrote: post #149

Earlier quoted context omitted.

We anthropomorphize these agents in every other way. Why aren't we using plain ol' unix user accounts to sandbox them? They look a lot like daemons to me, they're a program that you want hanging around ready to respond, and maybe act autonomously through cron jobs are similar. You want to assign any number of permissions to them, you don't want them to have access to root or necessarily any of your personal files. It…

> for some reason they want it to live under your user account The entire idea of Openclaw (i.e., the core point of what distinguishes it from agents like Claude Code) is to give it access to your personal data, so it can act as your assistant. If you only need a coding agent, Openclaw is the completely wrong tool. (As a side note, after using it for a few weeks, I'm not convinced it's the right tool for anything, bu…

It's still possible to give some restricted access to your personal data, through groups and such.

Re: Go hard on agents, not on your filesystem

#346

Post by jmalicki »

unshavedyak wrote: post #298
lxgr wrote: post #225

Earlier quoted context omitted.

It works well so far, for you . Are you confident it would still work against sophisticated prompt injection attacks that override your "strongly worded message"? Strongly worded signs can be great for safety (actual mechanisms preventing undesirable actions from being taken are still much better), but are essentially meaningless for security.

Not sure about OPs impl, but the wording doesn’t matter. The hook prevents the use of whatever action you want. Eg it’s impossible for Claude to use Emojis for me. My hook doesn’t allow it. So it’s deterministic based upon however the script it written

If your hook prevents rm, it is possible for Claude to write a script that does the rm and execute the script.

Re: Go hard on agents, not on your filesystem

#348

Post by [deleted] »

mazieres wrote: post #65
ray_v wrote: post #41

I'm wondering if the obvious (and stated) fact that the site was vibe-coded - detracts from the fact that this tool was hand written. > jai itself was hand implemented by a Stanford computer science professor with decades of C++ and Unix/linux experience. ( https://jai.scs.stanford.edu/faq.html#was-jai-written-by-an-... )

Human author here. The fact that I don't know web design shouldn't detract from my expertise in operating systems. I wrote the software and the man page, and those are what really matter for security. The web site is... let's say not in a million years what I would have imagined for a little CLI sandboxing tool. I literally laughed out loud when claude pooped it out, but decided to keep, in part ironically but also s…

[deleted]

Re: Go hard on agents, not on your filesystem

#349

Post by _se »

raincole wrote: post #126
lifis wrote: post #90

Earlier quoted context omitted.

It seems that the LLM has not only designed the site, but also written the text on at least the frontpage, which is a pretty bad signal. You need to rewrite all the text and Telde it with text YOU would actually write, since I doubt you would write in that style.

> You need to rewrite No they don't. The text is very clearly conveying what this project is about. Not everyone needs to cater to weirdos who are obsessed with policing how other people use LLM.

The people who don't care about LLM slop being shoved down their throat at every turn are the "weirdos" here. The project might not be slop, but the website certainly is, and it's perfectly reasonable for people to stop reading immediately and decide that they don't care about what could be an otherwise useful project when they determine that the author didn't give enough of a shit to even write the text on the website themselves.

Re: Go hard on agents, not on your filesystem

#350

Post by cruffle_duffle »

esperent wrote: post #73
mazieres wrote: post #57

Earlier quoted context omitted.

I've seen claude get confused about what directory it's in. And of course I've seen claude run rm -rf *. Fortunately not both at the same time for me, but not hard to imagine. The claude sandbox is a good idea, but to be effective it would need to be implemented at a very low level and enforced on all programs that claude launches. Also, claude itself is an enormous program that is mostly developed by AI. So to have…

I added a hook to disable rm, find - delete, and a few of the other more obvious destructive ops. It sends Claude a strongly worded message: "STOP IMMEDIATELY. DO NOT TRY TO FIND WORKAROUNDS...". It works well. Git rm is still allowed.

It will mess up eventually. It always does. People need to stop thinking of this is a “security against malicious actor” thing… because thinking in that way blinds you to the actual threat… Claude being helpful and accidentally running a command it shouldn’t. It’s happened to me twice now where it will do something irreversible and also incorrect. It wasn’t a threat actor, it wasn’t a bad guy… it was a very eager, incredibly clever assistant fat fingering something and goofing up. The more power you let them wield, the more chance they’ll do accidents. But without lots of power, they don’t really do much useful…

It’s actually a hard problem. But it really isn’t “security” in the classic sense…

Post reply on HN