9 ms·
Living Dangerously with Claude
- igor47 1y agoMy approach is to ask Claude to plan anything beyond a trivial change and I review the plan, then let it run unsupervised to execute the plan. But I guess this does still leave me vulnerable to prompt injection if part of the plan is accessing external content
- ares623 1y agoJust don’t think about it too much. You’ll be fine.
- abathologist 1y agoWhat guarantees do you have it will actually follow the stated plan instead of doing something else entirely?
- igor47 1y agoin my experience, it does tend to follow the plan pretty well.
- danielbln 1y agoClaude Code offers sandboxing now: https://www.anthropic.com/engineering/claude-code-sandboxing https://www.anthropic.com/engineering/claude-code-sandboxing
- js2 1y agoIt's discussed in the linked post.
- lacker 1y agoThe sandbox idea seems nice, it's just a question of how annoying it is in practice. For example the "Claude Code on the web" sandbox appears to prevent you from loading `https://api.github.com/repos/.../releases/latest https://api.github.com/repos/.../releases/latest`. Presumably that's to prevent you from doing dangerous GitHub API operations with escalated privileges, which is good, but it's currently breaking some of my setup scripts....
- simonw 1y agoIs that with their default environment? I have been running a bunch of stuff in there with a custom environment that allows "*"
- lacker 1y agoI whitelisted github.com, api.github.com, *.github.com, and it still doesn't seem to work. I suspect they did something specifically for github to prevent the agent from doing dangerous things with your credentials? But I could be wrong.
- matthewdgreen 1y agoSo let me get this straight. You’re writing tens of thousands of lines of code that will presumably go into a public GitHub repository and/or be served from some location. Even if it only runs locally on your own machine, at some point you’ll presumably give that code network access. And that code is being developed (without much review) by an agent that, in our threat model, has been fully subverted by prompt injection? Sandboxing the agent hardly seems like a sufficient defense here.
- simonw 1y agoWhat is your worst case scenario from this?
- noitpmeder 1y agoBank accounts drained, ransomware installed, ...
- deadbabe 1y agoSilently setup a child pornographer exchange server and run it on your machine for years without you ever noticing until you are caught and imprisoned.
- deleted 1y ago[deleted]
- tptacek 1y agoWhere did "without much review" come from? I don't see that in the deck.
- enraged_camel 1y agoYeah. Personally I haven't found a workflow that relies heavily on detailed design specs, red/green TDD followed by code review. And that's fine because that's how I did my work before AI anyway, both at the individual level and at the team level. So really, this is no different than reviewing someone else's PR, aside from the (greatly increased) turnaround time and volume.
- catigula 1y agoTelling Claude to solve a problem and walking away isn't a problem you solved. You weren't in the loop. You didn't complete any side quests or do anything of note, you merely watched an AGI work.
- simonw 1y agoHere's one I did even less work for: https://tools.simonwillison.net/terminal-to-html https://tools.simonwillison.net/terminal-to-html - prompt and video here: https://simonwillison.net/2025/Oct/23/claude-code-for-web-video/ https://simonwillison.net/2025/Oct/23/claude-code-for-web-vi...
- _factor 1y agoWriting your Java code on an IDE, you just sat by while the interpreter did all the work on the generated byte code and corresponding assembly. You merely watched the tools do the work.
- bitpush 1y agoThis exactly is the part that lots of folks are missing. As programmers in a high level language (C, Rust, Python ..) we were merely guiding the compiler to create code. You could say the compiler/interpreter is more deterministic, but the fact remains the code that is run is 100% not what you wrote, and you're at the mercy of the tool .. which we trust. Compiled output can change between versions, heck, can even change during runtime (JIT compilation).
- catigula 1y agoThe hubris here, which is very short-sighted, is the idea that a. You have very important contributions to make and b. You cannot possibly be replaced. If you're barely doing anything neither of these things can possibly be true even with current technology.
- deleted 1y ago[deleted]
- stuaxo 1y agoI've been thinking about this a bit. I reckon something lie Qubes could work fairly well. Create a new Qube and have control over network connectivity, and do everything there, at the end copy the work out and destroy it.
- BoredPositron 1y ago[flagged]
- simonw 1y agoThis particular post was a talk I gave in person on Tuesday. I have a policy of always writing up my talks, it's a little inconvenient that the one happened to coincide with a busy week for other content. What do you think of this one? I'm trying a new format: https://simonwillison.net/2025/Oct/23/claude-code-for-web-video/ https://simonwillison.net/2025/Oct/23/claude-code-for-web-vi...
- boredtofears 1y agoI like the best of both worlds approach of asking Claude to refine a spec with me (specifically instructing it to ask me questions) and then summarize an implementation or design plan (this might be a two step process if the feature is big enough) When I’m satisfied with the spec, I turn on “allow all edits” mode and just come back later to review the diff at the end. I find this works a lot better than hoping I can one shot my original prompt or having to babysit the implementation the whole way.
- wahnfrieden 1y agoI recommend trying a more capable model that will read much more context too when creating specs. You can load a lot of full files into GPT 5 Pro and have it produce a great spec and give more surgical direction to CC or Codex (which don’t read full files and often skip over important info in their haste). If you have it provide the relevant context for the agent, the agent doesn’t waste tokens gathering it itself and will proceed to its work.
- boredtofears 1y agoIs there an easy way to get a whole codebase into GPT 5 Pro? It's nice with claude to be able to say "examine the current project in the working directory" although maybe that's actually doing less than I think it is.
- simonw 1y agoI wrote a tool for that: https://github.com/simonw/files-to-prompt https://github.com/simonw/files-to-prompt - and there are other similar tools like repomix. These days I often use https://gitingest.com https://gitingest.com - it can grab any full repo on GitHub has something you can copy and paste, e.g. https://gitingest.com/simonw/llm https://gitingest.com/simonw/llm
- boredtofears 1y agoOf course you did - thanks, huge fan!
- almosthere 1y agoAnyone from the Cursor world already YOLO's it by default. A massive productivity boost I get is using to do server maintenance. Using gcloud compute ssh, log into all gh runners and run docker system prune, in parellel for speed and give me a summary report of the disk usage after. This is an undocumented and underused feature of basic agentic abilities. It doesn't have to JUST write code.
- simonw 1y agoDoes Cursor have a good sandboxing story?
- tuhgdetzhh 1y agoI run multiple instances of cursor cli yolo in a 4 x 3 tmux grid each in an isolated docker container. That is a pretty effective setup.
- dns_snek 1y agoThere's no sandbox of any kind, at least on Linux, and the permission system is self-defeating. The agent will ask to run something like `bash -c "npm test"` and ask you to whitelist "bash" for future use. I don't use it daily because I don't find it useful to begin with, but when I take it for a spin it's always inside a full VM.
- normie3000 1y agoIs this what ansible does? Or some other classic ops tool?
- mandevil 1y agoThere are a million different tools that are designed to do this, e.g. this task (log into a bunch of machines and execute a specific command without any additional tools running on each node) is literally the design use case for Ansible. It would be a simple playbook, why are you bringing AI into this at all?
- giobox 1y ago
- mike_hearn 1y agosandbox-exec isn't really deprecated. It's just a tiny wrapper around some semi-private undocumented APIs, it says that because it's not intended for public use. If it were actually deprecated Apple would have deleted it at some point, or using it would trigger a GUI warning, or it'd require a restricted entitlement. The reason they don't do that is because some popular and necessary apps use it. Like Chrome. However, I tried this approach too and it's the wrong way to go IMHO, quite beyond the use of undocumented APIs. What you actually want to do is virtualize, not sandbox.
- krackers 1y agoFun fact: the sandboxing rules are defined using scheme!
- jampa 1y agoI don't understand why people advocate so strongly for `--dangerously-skip-permissions`. Setting up "permissions.allow" in `.claude/settings.local.json` takes minimal time. Claude even lets you configure this while approving code, and you can use wildcards like "Bash(timeout:*)". This is far safer than risking disasters like dropping a staging database or deleting all unstaged code, which Claude would do last week, if I were running it in the YOLO mode. The worst part is seeing READMEs in popular GitHub repos telling people to run YOLO mode without explaining the tradeoffs. They just say, "Run with these parameters, and you're all good, bruh," without any warning about the risks. I wish they could change the parameter to signify how scary it can be, just like React did with React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED (https://github.com/reactjs/react.dev/issues/3896 https://github.com/reactjs/react.dev/issues/3896)
- dist-epoch 1y agoI tried this path. The issue is that agents are very creating in coming up with new variations. "uv run pytest", "python3 -m pytest", "bash -c pytest" It's a never ending game of whitelisting.
- Jianghong94 1y agothis seem solvable if the whitelisting just allows regex
- bdangubic 1y agochanging the parameter name to something scary will only increase its usage
- ZeroConcerns 1y agoSo, yeah, only tangentially related, but if anyone at Anthropic would see it fit to let Claude loose on their DNS, maybe they can create an MX record for 'email.claude.com'? That would mean that their, undoubtedly extremely interesting, emails actually get met with more than a "450 4.1.8 Unable to find valid MX record for sender domain" rejection. I'm sure this is just an oversight being caused by obsolete carbon lifeforms still being in charge of parts of their infrastructure, but still...
- tryauuum 1y agoa not really related fact. I remember reading some RFC, and the sender should try sending to the server specified in A record if there are no MX records present
- deleted 1y ago[deleted]
- zxilly 1y agoI should like to know how much this would cost? Even Claude's largest subscription appears insufficient for such token requirements.
- simonw 1y agoI ran a cost estimate on the project I describe in https://simonwillison.net/2025/Oct/23/claude-code-for-web-video/ https://simonwillison.net/2025/Oct/23/claude-code-for-web-vi... - which was covered by my Claude Max account, but I dug through the JSONL log files for that session to try and estimate the cost if I had been using the API. The cost estimate came out to 63 cents - details here: https://gistpreview.github.io/?27215c3c02f414db0e415d3dbf978760 https://gistpreview.github.io/?27215c3c02f414db0e415d3dbf978...
- jh3 1y agoWhat are you doing to keep a JSONL per session? Or is this something built in? I’m interested in estimating token costs in this way.
- simonw 1y agoIt's built in - the ~/.claude/projects folder stores the JSONL for 30 days or you can extend the retention time like this: https://simonwillison.net/2025/Oct/22/claude-code-logs/ https://simonwillison.net/2025/Oct/22/claude-code-logs/
- pdntspa 1y agoI guess it's great if you don't give a shit about code quality, particularly in a larger project. What I see are three tiny little projects that do one thing. That is boring. We already know the LLMs are good at that. Let's see it YOLO into a larger codebase with protocols and a growing feature set without making a complete mess of things. So far CC has been great for letting me punch above my weight but the few times I let it run unattended it has gone against conventions clearly established in AGENTS.md and I wasn't there to keep it on the straight and narrow. So a bunch more time had to be spent untangling the mess it created.
- Zarathruster 1y agoYeah I don't know if this is a skill issue on my part, the nature of my projects, the limits of Sonnet vs. Opus, or a combination of all of the above, but my experiences track with all of yours. From the article: > The default mode requires you to pay constant attention to it, tracking everything it does and actively approving changes and actions every few steps. I've never seen a YOLO run that doesn't require me to pay constant attention to it. Within a few minutes, Claude will have written bizarre abstractions, dangerous delegations of responsibility, and overall the smelliest code you'll see outside of a coding bootcamp. And god help you if you have both client and server code within the same repo. In general Claude seems to think that it's fine to wreak havoc in existing code, for the purpose of solving whatever problem is immediately at hand. Claude has been very helpful to me, but only with constant guidance. Believe me, I would very much like to YOLO my problems away without any form of supervision. But so far, the only useful info I've received is to 1) only use it for side projects/one-off tools, and 2) make sure to run it in a sandbox. It would be far more useful to get an explanation for how to craft a CLAUDE.md (or, more generally, get the right prompt) that results in successful YOLO runs.
- tug2024 1y ago[dead]
- burgerquizz 1y agoclaude condom gives you protection on claude YOLO mode https://github.com/nikvdp/cco https://github.com/nikvdp/cco
- croemer 1y agoBy default can still read anything, including all secrets in .env files, kubernetes credentials etc
- corv 1y agoWe've been exploring libseccomp/BPF filters on top of bubblewrap namespaces for LLM sandboxing - the BPF layer lets you go beyond read-only mounts to syscall restrictions. Open to collaboration on pushing this further: https://github.com/corv89/shannot https://github.com/corv89/shannot
- yencabulator 1y ago> That way the worst that can happen is someone else’s computer getting owned. That way the worst thing that can happen is that you later (accidentally) trust the result of that work.