6 ms·

Of course, I love fetching shell commands from endpoints I don't control, and executing them blindly. See also https://github.com/timofurrer/russian-roulette h

Of course, I love fetching shell commands from endpoints I don't control, and executing them blindly. See also https://github.com/timofurrer/russian-roulette https://github.com/timofurrer/russian-roulette It's not your computer any more, it's theirs; you gave it to them willingly.

Chabsff 1y ago
Wait. Do people run agents as their own user? Does nobody setup a dedicated user/group with a very specific set of permissions? It's not even hard to do! *NIX systems are literally designed to handle stuff like this easily.
- jvanderbot 1y ago
  No I'm fairly certain almost nobody does that.
- andai 1y ago
  I'd have to follow some kind of tutorial, or more realistically, ask the AI to set it up for me ;)
- johnQdeveloper 1y ago
  I only run AI within docker containers so kinda?
  - deleted 1y ago
    [deleted]
- mrklol 1y ago
  Same with the browser agents, they are used in a browser where you‘re also logged into your usual accounts. Means in theory they can simply mail everyone something funny, do some banking (probably not but could work for some banks) or something else. Endless possibilities
- mathiaspoint 1y ago
  I run mine as it's own user and self host the model. Unlike most services the ai service user has a login shell and home directory.
  - MadnessASAP 1y ago
    What's its preferred shell and window manager?
    - mathiaspoint 1y ago
      It just uses bash. I haven't been giving it an X session yet although I probably will start at some point since the newer models can handle it.
      - MadnessASAP 1y ago
        Thank you for a serious answer to a facetious question.
- electroly 1y ago
  VMs are common, consider going that additional step. Once you have one agent, it's natural to want two agents, and now they will interfere with each other if they start running servers that bind to ports. One agent per VM solves this and a lot of other issues.
- adastra22 1y ago
  That seems hardly sufficient. You are still exposing a massive attack surface. I run within a rootless docker container.
  - deleted 1y ago
    [deleted]
- f33d5173 1y ago
  User level separation, while it has improved over the years, was not originally designed assuming unprivileged users were malicious, and even today privilege escalation bugs regularly pop up. If you are going to use it as a sandboxing mechanism, you should at least ensure the sandboxed user doesn't have access to any suid binaries as these regularly have exploits found in them.
- mansilladev 1y ago
  An agent can be designed to run with permissions of a system/bot account; however, others can be designed to execute things under user context, using OAuth to get user consent.
mark_l_watson 1y ago
I was just reading the code: it looks like minor tweaks to utils.c and this should run nicely with local models using Ollama or LM Studio. That should be safe enough. Off topic, sorry, but to me the real security nightmare is the new ‘AI web browsers’ - I can’t imagine using one of those because of prompt injection attacks.
- pushedx 1y ago
  A local model will be just as happy to provide a shell command that trashes your local disks as any remote one.
kordlessagain 1y ago
> I love fetching shell commands from endpoints I don't control, and executing them blindly. Your link suggests running them in Docker, so what's the problem?
deleted 1y ago
[deleted]

Chabsff 1y ago

Wait. Do people run agents as their own user? Does nobody setup a dedicated user/group with a very specific set of permissions? It's not even hard to do! *NIX systems are literally designed to handle stuff like this easily.

jvanderbot 1y ago
No I'm fairly certain almost nobody does that.
andai 1y ago
I'd have to follow some kind of tutorial, or more realistically, ask the AI to set it up for me ;)
johnQdeveloper 1y ago
I only run AI within docker containers so kinda?
- deleted 1y ago
  [deleted]
mrklol 1y ago
Same with the browser agents, they are used in a browser where you‘re also logged into your usual accounts. Means in theory they can simply mail everyone something funny, do some banking (probably not but could work for some banks) or something else. Endless possibilities
mathiaspoint 1y ago
I run mine as it's own user and self host the model. Unlike most services the ai service user has a login shell and home directory.
- MadnessASAP 1y ago
  What's its preferred shell and window manager?
  - mathiaspoint 1y ago
    It just uses bash. I haven't been giving it an X session yet although I probably will start at some point since the newer models can handle it.
    - MadnessASAP 1y ago
      Thank you for a serious answer to a facetious question.
electroly 1y ago
VMs are common, consider going that additional step. Once you have one agent, it's natural to want two agents, and now they will interfere with each other if they start running servers that bind to ports. One agent per VM solves this and a lot of other issues.
adastra22 1y ago
That seems hardly sufficient. You are still exposing a massive attack surface. I run within a rootless docker container.
- deleted 1y ago
  [deleted]
f33d5173 1y ago
User level separation, while it has improved over the years, was not originally designed assuming unprivileged users were malicious, and even today privilege escalation bugs regularly pop up. If you are going to use it as a sandboxing mechanism, you should at least ensure the sandboxed user doesn't have access to any suid binaries as these regularly have exploits found in them.
mansilladev 1y ago
An agent can be designed to run with permissions of a system/bot account; however, others can be designed to execute things under user context, using OAuth to get user consent.

mark_l_watson 1y ago

I was just reading the code: it looks like minor tweaks to utils.c and this should run nicely with local models using Ollama or LM Studio. That should be safe enough. Off topic, sorry, but to me the real security nightmare is the new ‘AI web browsers’ - I can’t imagine using one of those because of prompt injection attacks.

pushedx 1y ago
A local model will be just as happy to provide a shell command that trashes your local disks as any remote one.

kordlessagain 1y ago

> I love fetching shell commands from endpoints I don't control, and executing them blindly. Your link suggests running them in Docker, so what's the problem?

deleted 1y ago

[deleted]