Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Observed Agent Sandbox Bypasses

voratiq.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Observed Agent Sandbox Bypasses

#41

Post by embedding-shape »

AdieuToLogic wrote: post #23
embedding-shape wrote: post #15

Earlier quoted context omitted.

> The whole idea of putting "agentic" LLMs inside a sandbox What is the alternative? Granted you're running a language model and has it connected to editing capabilities, then I very much like it to be disconnected from the rest of my system, seems like a no-brainer.

>> The whole idea of putting "agentic" LLMs inside a sandbox sounds like rubbing two pieces of sandpaper together in the hopes a house will magically build itself. > What is the alternative? Don't expect to get a house from rubbing two pieces of sandpaper together?

Fitting username, if nothing else.

Re: Observed Agent Sandbox Bypasses

#42

Post by corv »

Great documentation of the problem! The bypasses logged all stem from the same root problem: policy sandboxes give agents constraints to optimize against.

I’ve been exploring a different model: capture intent instead of blocking actions. Scripts run in a PyPy sandbox providing syscall interception so all commands and file writes get recorded. Human reviews the full diff before anything touches the real system.

No policies to bypass because there’s nothing to block! The agent does whatever it wants in the sandbox, you just see exactly what it wanted to mutate before approving.

WIP but core works: https://github.com/corv89/shannot

Re: Observed Agent Sandbox Bypasses

#43

Post by bastawhiz »

SirMaster wrote: post #27
bastawhiz wrote: post #24

Earlier quoted context omitted.

Non-sentient technology has no concept of good or bad. We have no idea how to give it one. Even if we gave it one, we'd have no idea how to teach it to "choose good". > In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. An AI teammate should be no different. That misses the point completely. How many of your coworkers…

But we do give humans responsibility to govern and manage critical things. We do give intrinsic trust to people. There are people at your company who have high level access and could do bad things, but they don't do it because they know better. This article acts like we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals. IMO that's a fools errand because y…

> they don't do it because they know better.

That's completely false. People get deceived all the time. We even have a word for it: social engineering.

> we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals

Right now we can't! AI is currently the equivalent of a very smart child. Would you give production access to a child?

> you can never really completely secure something and ensure there are no possible exploits.

This applies to any system, not just AI.

Re: Observed Agent Sandbox Bypasses

#44

Post by SirMaster »

bastawhiz wrote: post #43
SirMaster wrote: post #27

Earlier quoted context omitted.

But we do give humans responsibility to govern and manage critical things. We do give intrinsic trust to people. There are people at your company who have high level access and could do bad things, but they don't do it because they know better. This article acts like we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals. IMO that's a fools errand because y…

> they don't do it because they know better. That's completely false. People get deceived all the time. We even have a word for it: social engineering. > we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals Right now we can't! AI is currently the equivalent of a very smart child. Would you give production access to a child? > you can never really complete…

> AI is currently the equivalent of a very smart child. Would you give production access to a child?

I mean this is my point! Why are we asking a child to do anything remotely important at all?

Maybe we should wait until the tech is an adult before we start having it do important things for us.

Mitigating the naiveness and recklessness of a child AI by attempting to lock down the environment as best we can seems foolish and short sighted to me and will probably not end well.

Re: Observed Agent Sandbox Bypasses

#45

Post by SirMaster »

hephaes7us wrote: post #35
SirMaster wrote: post #30

Earlier quoted context omitted.

Do you trust your IT and security teams to have access to your shell or access to delete your entire code repo?

Personally, no. If I'm responsible for something, nobody's getting that access. If someone's hired me for something and that's the environment they provide, it is what it is. They distribute trust however they feel. I'd argue that's still more reasonable than giving similar access to an AI agent though.

I don’t think we should even be considering releasing AI Agents until they are at least as trustworthy as the trusted humans we normally put in place to do the same task.

Re: Observed Agent Sandbox Bypasses

#46

Post by charcircuit »

charcircuit wrote: post #32
SirMaster wrote: post #28

Earlier quoted context omitted.

Sure we treat most that way, but we do give trust and access to some people. This doesn't seem like the same concept here to me.

Even so those people are still monitored and systems can trip flashes if they start acting suspicious.

Trip flags.

Re: Observed Agent Sandbox Bypasses

#47

Post by kaffekaka »

ianlevesque wrote: post #11
kaffekaka wrote: post #3

I am testing running agents in docker containers, with a script for managing different images for different use cases etc, and came across this: https://docs.docker.com/ai/sandboxes/ Has anyone given it a try?

Yes but it’s barely usable. I ended up making my own Dockerfile and a bash script to just ‘docker run’ my setup itself, and as a bonus you don’t need Docker Desktop. I might open source it at some point but honestly it’s pretty trivial to just append a couple of volume mount flags and env vars to your docker run and have exactly what you want included.

Yes this is what I have done as well.

But I also run Claude as its own user on my linux system. This way it is constrained by the OS user permissions instead of docker. Not sure of pro/con yet though.

Re: Observed Agent Sandbox Bypasses

#48

Post by kaffekaka »

SirMaster wrote: post #45
hephaes7us wrote: post #35

Earlier quoted context omitted.

Personally, no. If I'm responsible for something, nobody's getting that access. If someone's hired me for something and that's the environment they provide, it is what it is. They distribute trust however they feel. I'd argue that's still more reasonable than giving similar access to an AI agent though.

I don’t think we should even be considering releasing AI Agents until they are at least as trustworthy as the trusted humans we normally put in place to do the same task.

You have a point, but a difference is that humans can be held accountable. The IT guy may break my machine but he will probably get shit for it.

Re: Observed Agent Sandbox Bypasses

#49

Post by SirMaster »

kaffekaka wrote: post #48
SirMaster wrote: post #45

Earlier quoted context omitted.

I don’t think we should even be considering releasing AI Agents until they are at least as trustworthy as the trusted humans we normally put in place to do the same task.

You have a point, but a difference is that humans can be held accountable. The IT guy may break my machine but he will probably get shit for it.

I mean I feel like this can all keep extending. Those who are deicing to run the AI agents are vouching for them, so they should be held accountable.

I guess that is what this is about, and those who are deploying them will feel confident enough in them if they feel they have the resources and environments in which they are running in locked down tight enough.

But as the models get "smarter and smarter" I am not sure we are going to be able to keep environments locked down well enough against exploits that they will apparently try to use to bypass things.

It seems a bit strange to me that we can generally ask these models moral questions and I think they would largely get things right as far as what most humans would deem right and wrong, such as performing an exploit to bypass some environment restrictions, yet the same model will still choose to perform the exploit to bypass. I wonder, what gives?

Re: Observed Agent Sandbox Bypasses

#50

Post by bastawhiz »

SirMaster wrote: post #44
bastawhiz wrote: post #43

Earlier quoted context omitted.

> they don't do it because they know better. That's completely false. People get deceived all the time. We even have a word for it: social engineering. > we can never possibly give that sort of trust to AI because it's never really on our side or aligned with our goals Right now we can't! AI is currently the equivalent of a very smart child. Would you give production access to a child? > you can never really complete…

> AI is currently the equivalent of a very smart child. Would you give production access to a child? I mean this is my point! Why are we asking a child to do anything remotely important at all? Maybe we should wait until the tech is an adult before we start having it do important things for us. Mitigating the naiveness and recklessness of a child AI by attempting to lock down the environment as best we can seems fool…

Whether it's being used inappropriately for production use and studying it to understand how to make it not be irresponsible to use in production are very separate things. What you're implying is that we should somehow magically leapfrog the current state of the art to a future version that solves all the problems with the current generation. Or, that we should ignore the technology entirely because developing it through the period where it's less robust than a mature human is too reckless.

The answer is that doing research isn't mutually exclusive with using the technology in appropriate ways. You can responsibly use AI while folks study threat models and model behavior for use cases that aren't able to be deployed responsibly.

> by attempting to lock down the environment as best we can

We literally do this as a best practice generally for traditional systems and human access. It even has a name: least privilege.

Post reply on HN