5 ms·

Claude code is by all accounts a revolutionary tool for getting useful work done on a computer. It's also: - a NodeJS app - installed by curling a shell scri

Claude code is by all accounts a revolutionary tool for getting useful work done on a computer. It's also: - a NodeJS app - installed by curling a shell script and piping it into bash - an LLM that's given free reign to mess with the filesystem, run commands, etc. So that's what, like 3 big glaring vectors of attack for your system right there? I would never feel comfortable running it outside of some kind of sandbox, e.g. VM, container, dedicated dev box, etc.

kasey_junk 1y ago
I definitely think running agents in sandboxes is the way to go. That said Claude code does not have free reign to run commands out of the gate.
- sneak 1y ago
  Yes it does; you are thinking of agent tool calls. The software package itself runs as your uid and can do anything you can do (except on macOS where reading of certain directories is individually gated).
  - otterley 1y ago
    Claude Code is an agent. It will not call any tools or commands without your prior consent. Edit: unless you pass it an override like --dangerously-skip-permissions, as this malware does. https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware https://www.stepsecurity.io/blog/supply-chain-security-alert...
  - kasey_junk 1y ago
    Ok, but that’s true of _any_ program you install so isn’t interesting. I don’t think the current agent tool call permission model is _right_ but it exists, so saying by default it will freely run those calls is less true of agents than other programs you might run.
    - sneak 1y ago
      Not all programs misbehave in this way. Signal desktop lets you turn off this vulnerability, and of course iOS apps and normal macOS apps are not allowed to self-modify, as it breaks their signature. https://github.com/signalapp/Signal-Desktop/issues/4578 https://github.com/signalapp/Signal-Desktop/issues/4578 https://github.com/syncthing/syncthing-macos/issues/122 https://github.com/syncthing/syncthing-macos/issues/122
- fwip 1y ago
  Pet peeve - it's free rein, not free reign. It's a horse riding metaphor.
  - 0cf8612b2e1e 1y ago
    Bah, well I have been using that incorrectly my entire life. A monarchy/ruler metaphor seems just as logical.
    - woollysammoth 1y ago
      There's a term "eggcorns" for these logical misinterpretations - https://en.wikipedia.org/wiki/Eggcorn https://en.wikipedia.org/wiki/Eggcorn
sneak 1y ago
None of this is the concerning part. The bad part is that it auto-updates while running without intervention - i.e. it is RCE on your machine for Anthropic by design.
- christophilus 1y ago
  Mine doesn’t auto update. I set it up so it doesn’t have permission to do that.
- jpalawaga 1y ago
  So we’re declaring all software with auto-updaters as RCE? That doesn’t seem like a useful distinction.
  - skydhash 1y ago
    That’s pretty much the definition. Auto updating is trusting the developer (Almost always a bad idea).
    - deleted 1y ago
      [deleted]
    - mr_mitm 1y ago
      Simply running the software means trusting the developer. But even then, do you really read the commits comprising the latest Firefox update? How would I review the updates for my cell phone? I just hit "okay", or simply set up auto updates.
      - skydhash 1y ago
        I trust Debian, and I do trust Firefox. I also trust Node, NPM, and Yarn. But I don’t trust the myriad packages in some rando projects. So who I trust got installed by apt. Anyone else is relocated to a VM or some kind of sandbox.
        1y ago
saberience 1y ago
So what? It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work. Claude Code is the most amazing and game changing tool I've used since I first used a computer 30 years ago. I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.
- OJFord 1y ago
  It doesn't have to be a deliberate 'attack', Claude can just do something absurdly inappropriate that wasn't what you intended. You're absolutely right! I should not have `rm -rf /bin`d!
  - bethekidyouwant 1y ago
    I don’t use Claude, but can it really run commands on the cli without human confirmation? Sure there may be a switch to allow this but If in that case all but the most yolo must be using it in a container?
    - 0x3f 1y ago
      By default it asks before running commands. The options when it asks are something like [1] Yes [2] Yes, and allow this specific command for the rest of this session [3] No
    - mr_mitm 1y ago
      There are scenarios in which you allow it to run python or uv for the session (perhaps because you want it to run tests on its own), and then for whatever reason it could run `subprocess.run("rm -rf / --no-preserve-root".split())` or something like that. I use it in a container, so at worst it can delete my repository.
    - 1y ago

kasey_junk 1y ago

I definitely think running agents in sandboxes is the way to go. That said Claude code does not have free reign to run commands out of the gate.

sneak 1y ago
Yes it does; you are thinking of agent tool calls. The software package itself runs as your uid and can do anything you can do (except on macOS where reading of certain directories is individually gated).
- otterley 1y ago
  Claude Code is an agent. It will not call any tools or commands without your prior consent. Edit: unless you pass it an override like --dangerously-skip-permissions, as this malware does. https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware https://www.stepsecurity.io/blog/supply-chain-security-alert...
- kasey_junk 1y ago
  Ok, but that’s true of _any_ program you install so isn’t interesting. I don’t think the current agent tool call permission model is _right_ but it exists, so saying by default it will freely run those calls is less true of agents than other programs you might run.
  - sneak 1y ago
    Not all programs misbehave in this way. Signal desktop lets you turn off this vulnerability, and of course iOS apps and normal macOS apps are not allowed to self-modify, as it breaks their signature. https://github.com/signalapp/Signal-Desktop/issues/4578 https://github.com/signalapp/Signal-Desktop/issues/4578 https://github.com/syncthing/syncthing-macos/issues/122 https://github.com/syncthing/syncthing-macos/issues/122
fwip 1y ago
Pet peeve - it's free rein, not free reign. It's a horse riding metaphor.
- 0cf8612b2e1e 1y ago
  Bah, well I have been using that incorrectly my entire life. A monarchy/ruler metaphor seems just as logical.
  - woollysammoth 1y ago
    There's a term "eggcorns" for these logical misinterpretations - https://en.wikipedia.org/wiki/Eggcorn https://en.wikipedia.org/wiki/Eggcorn

sneak 1y ago

None of this is the concerning part. The bad part is that it auto-updates while running without intervention - i.e. it is RCE on your machine for Anthropic by design.

christophilus 1y ago
Mine doesn’t auto update. I set it up so it doesn’t have permission to do that.
jpalawaga 1y ago
So we’re declaring all software with auto-updaters as RCE? That doesn’t seem like a useful distinction.
- skydhash 1y ago
  That’s pretty much the definition. Auto updating is trusting the developer (Almost always a bad idea).
  - deleted 1y ago
    [deleted]
  - mr_mitm 1y ago
    Simply running the software means trusting the developer. But even then, do you really read the commits comprising the latest Firefox update? How would I review the updates for my cell phone? I just hit "okay", or simply set up auto updates.
    - skydhash 1y ago
      I trust Debian, and I do trust Firefox. I also trust Node, NPM, and Yarn. But I don’t trust the myriad packages in some rando projects. So who I trust got installed by apt. Anyone else is relocated to a VM or some kind of sandbox.
      - 1y ago

saberience 1y ago

So what? It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work. Claude Code is the most amazing and game changing tool I've used since I first used a computer 30 years ago. I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.

OJFord 1y ago
It doesn't have to be a deliberate 'attack', Claude can just do something absurdly inappropriate that wasn't what you intended. You're absolutely right! I should not have `rm -rf /bin`d!
- bethekidyouwant 1y ago
  I don’t use Claude, but can it really run commands on the cli without human confirmation? Sure there may be a switch to allow this but If in that case all but the most yolo must be using it in a container?
  - 0x3f 1y ago
    By default it asks before running commands. The options when it asks are something like [1] Yes [2] Yes, and allow this specific command for the rest of this session [3] No
  - mr_mitm 1y ago
    There are scenarios in which you allow it to run python or uv for the session (perhaps because you want it to run tests on its own), and then for whatever reason it could run `subprocess.run("rm -rf / --no-preserve-root".split())` or something like that. I use it in a container, so at worst it can delete my repository.
  - 1y ago