7 ms·
I'm not surprised to see these horror stories... The `--dangerously-skip-permissions` flag does exactly what it says. It bypasses every guardrail and runs comm
by orliesaurus 10mo ago
I'm not surprised to see these horror stories...
The `--dangerously-skip-permissions` flag does exactly what it says. It bypasses every guardrail and runs commands without asking you. Some guides I’ve seen stress that you should only ever run it in a sandboxed environment with no important data
Claude Code dangerously-skip-permissions: Safe Usage Guide[1].
Treat each agent like a non human identity, give it just enough privilege to perform its task and monitor its behavior Best Practices for Mitigating the Security Risks of Agentic AI [2].
I go even further. I never let an AI agent delete anything on its own. If it wants to clean up a directory, I read the command and run it myself. It's tedious, BUT it prevents disasters.
ALSO there are emerging frameworks for safe deployment of AI agents that focus on visibility and risk mitigation.
It's early days... but it's better than YOLO-ing with a flag that literally has 'dangerously' in its name.
[1] https://www.ksred.com/claude-code-dangerously-skip-permissions-when-to-use-it-and-when-you-absolutely-shouldnt/#:~:text=Claude%20Code%20dangerously,The%20Bottom%20Line https://www.ksred.com/claude-code-dangerously-skip-permissio...
[2] https://preyproject.com/blog/mitigating-agentic-ai-security-risks#:~:text=Once%20there%27s%20visibility%2C%20teams%20can,behavior%20continuously%2C%20and%20flag%20anomalies https://preyproject.com/blog/mitigating-agentic-ai-security-...
- mjd 10mo agoA few months ago I noticed that even without `--dangerously-skip-permissions`, when Claude thought it was restricting itself to directory D, it was still happy to operate on file `D/../../../../etc/passwd`. That was the last time I ran Claude Code outside of a Docker container.
- Dylan16807 10mo agoBy operate on you mean that actually got through and it opened the file?
- mjd 10mo agoYes, although the example I had it operate on was different.
- SoftTalker 10mo agoYou don't even need a container. Make claude a local user. Without sudo permission. It will be confined to damaging its own home directory only.
- mjd 10mo agoAnd reading any world-readable file. No thanks, containers it is.
- AnimalMuppet 10mo agoAnd writing or deleting any world-writable file. "Read" is not at the top of my list of fears.
- nimchimpsky 10mo ago[dead]
- SoftTalker 10mo agoWe run linux machines with hundreds of user accounts, it's safe. Why would you make any important files world-writable?
- AnimalMuppet 10mo agoWell, let's say you weren't on a machine with hundreds of users. Let's say you were on your own machine (either as a solo dev, or on a personal - that is, non server - machine at work). Now, does that machine have any important files that are world-writable? How sure are you? Probably less sure than for that machine with hundreds of users...
- oskarkk 10mo agoIf you're not sure if there are any important world-writable files, then just check that? On Linux you can do something like "find . -perm /o=w". And you can easily make whole dirs inaccessible to other users (chmod o-x). It's only a problem if you're a developer who doesn't know how to check and set file permissions. Then I wouldn't advise running any commands given by an AI.
- ehnto 10mo agoIt will happily run bash commands, which expands it's reach pretty widely. It's not limited to file operations, and can run system wide commands with your user permissions.
- classified 10mo agoAnd `sudo`, if your user ID allows it!
- wpm 10mo agoSeems like the best way to limit its ability to destroy things is to run it as a separate user without sudo capabilities if the job allows. That said running basic shell commands seems like the absolute dumbest way to spend tokens. How much time are you really saving?
- forrestthewoods 10mo agoAI tools are honestly unusable without running in yolo mode. You have to baby every single little command. It is utterly miserable and awful.
- skeledrew 10mo agoBetter to continuously baby than to have intense regrets.
- ehnto 10mo agoI have to correct a few commands basically every interaction with AI, so I think YOLO mode would get me subpar outcomes.
- forrestthewoods 10mo agoIf it gets the command wrong it’s exceedingly unlikely to be a catastrophic failure. So it’d probably just figure it out on its own.
- ehnto 10mo agoI mean the direction of the AIs general tasking, it will do the command correctly but what it's trying to achieve isn't going in the right direction for whatever reason. You might be tempted to suggest a fix, but I truly mean for "whatever reason". There's dozens of different ways the AI gets onto a bad path, I would rather catch it early rather than come back to a failed run and have to start again.
- forrestthewoods 10mo agoI suppose the real question here is “how often should I check on the AI and course correct”. My experience is if you have to manually approve every tool invocation the we’re talking every 3 to 15 seconds. This is infuriating and makes me want to flip tables. The worst possible cadence. Every 5 or 15 minutes is more tolerable. Not too long for it to have gone crazy and wasted time. Short enough that I feel like I have a reasonable iteration cadence. But not too short that I can’t multi-task.
- JumpCrisscross 10mo ago> I'm not surprised to see these horror stories I am! To the point that I don’t believe it! You’re running an agentic AI and can parse through logs, but you can’t sandbox or back up? Like, I’ve given Copilot permission to fuck with my admin panel. It promptly proceeded to bill thousands of dollars, drawing heat maps of the density of built structures in Milwaukee; buying subscriptions to SAP Joule and ArcGIS for Teams; and generating terabytes of nonsense maps, ballistic paths and “architectural sketch[es] of a massive bird cage the size of Milpitas, California (approximately 13 square miles)” resembling “a futuristic aviary city with large domes, interconnected sky bridges, perches, and naturalistic environments like forests, lakes, and cliffs inside.” But support immediately refunded everything. I had backups. And it wound up hilarious albeit irritating.
- fwipsy 10mo agoCan you post the birdcage thing? That sounds fascinating.
- deleted 10mo ago[deleted]
- JumpCrisscross 10mo agoLiterally terabytes of Word and PowerPoint documents displaying and debating various ways to build big bird cages. In Milpitas. I noticed the nonsense due to an alert that my OneDrive was over limit, which caught my attention, since I don’t use OneDrive. If I prompted a half-decent LLM to run up billables, I doubt I could have done a better job.
- transcriptase 10mo agoWe’re far more interested in what the heck you were trying to do (and how) that resulted in that outcome…
- JumpCrisscross 10mo ago
- postalcoder 10mo agoWhile I agree that `--dangerously-skip-permissions` is (obviously) dangerous, it shouldn't be considered completely inaccessible to users. A few safeguards can sand off most of the rough edges. What I've done is write a PreToolUse hook to block all `rm -rf` commands. I've also seen others use shell functions to intercept `rm` commands and have it either return a warning or remap it to `trash`, which allows you to recover the files.
- 112233 10mo agoDoes your hook also block "rm -rf" implemented in python, C or any other language available to the LLM? One obviously safe way to do this is in a VM/container. Even then it can do network mischief
- doubled112 10mo agoI’ve heard of people running “rm -Rf” incorrectly and deleting their backups too since the NAS was mounted. I could certainly see it happening in a VM or container with an overlooked mount.
- Retr0id 10mo ago> Treat each agent like a non human identity Why special-case it as a non-human? I wouldn't even give a trusted friend a shell on my local system.
- stevefan1999 10mo agoThat's exactly why I let the LLM run read-only commands automatically, but anything that could potentially trigger mutation (either removal or insertion) requires manual intervention. Another way to prevent this is to run a filesystem snapshot each mutation command approval (that's where COW based filesystems like ZFS and BTRFS would shine), except you also have to block the LLM from deleting your filesystem and snapshots, or dd'ing stuff to your block devices to corrupt it, and I bet it will eventually evolve into this egregiously.