3 ms·

Rather than spending iterations crafting precise permissions, why not just run with --dangerously-skip-permissions If run in a devcontainer[1][2], the wor

Rather than spending iterations crafting precise permissions, why not just run with --dangerously-skip-permissions If run in a devcontainer[1][2], the worst thing that can happen is it deletes everything in the filesystem below the mounted repo. Recovery would entail checking out the repo again. 1. (conventional usage) https://code.visualstudio.com/docs/devcontainers/containers https://code.visualstudio.com/docs/devcontainers/containers 2. (actual spec) https://containers.dev/ https://containers.dev/

falloutx 9mo ago
Still leaves you open for data exfil. Your AI goes to a site to check documentation, but oh no that site wants it to make an API call with a very specific token.
- 9dev 9mo ago
  Claude will only ever ask if it is allowed to connect to the domain name, so if it got a malicious link from a web search, you’re SOL anyway.
  - falloutx 9mo ago
    atleast you get one prompt, with --dangerously-skip-permissions you get no prompts
bob1029 9mo ago
On windows I create a new locked down user with NTFS permissions denied everywhere except the target project path. I then run the agent app as that user with otherwise unrestricted powershell access.
jaggederest 9mo ago
Be careful running claude in a devcontainer with no other restrictions - it at least nominally knows how to jailbreak out of containers, even though it appears heavily moralized not to. If you (for example) feed it arbitrary web data that contains a prompt sufficiently persuasive to get to try, it's pretty capable of doing it.
- utopiah 9mo ago
  > it at least nominally knows how to jailbreak out of containers Source please. If it's contained (as in Claude runs INSIDE the container, not outside while having access to it) I don't understand how it technically could blue pill out of it. If it were to be able to leave the container then the container code would be updating accordingly to patch whatever exploit was found somehow. So I don't believe this but maybe I'm wrong, hence why I'm asking for a reference.

falloutx 9mo ago

Still leaves you open for data exfil. Your AI goes to a site to check documentation, but oh no that site wants it to make an API call with a very specific token.

9dev 9mo ago
Claude will only ever ask if it is allowed to connect to the domain name, so if it got a malicious link from a web search, you’re SOL anyway.
- falloutx 9mo ago
  atleast you get one prompt, with --dangerously-skip-permissions you get no prompts

bob1029 9mo ago

On windows I create a new locked down user with NTFS permissions denied everywhere except the target project path. I then run the agent app as that user with otherwise unrestricted powershell access.

jaggederest 9mo ago

Be careful running claude in a devcontainer with no other restrictions - it at least nominally knows how to jailbreak out of containers, even though it appears heavily moralized not to. If you (for example) feed it arbitrary web data that contains a prompt sufficiently persuasive to get to try, it's pretty capable of doing it.

utopiah 9mo ago
> it at least nominally knows how to jailbreak out of containers Source please. If it's contained (as in Claude runs INSIDE the container, not outside while having access to it) I don't understand how it technically could blue pill out of it. If it were to be able to leave the container then the container code would be updating accordingly to patch whatever exploit was found somehow. So I don't believe this but maybe I'm wrong, hence why I'm asking for a reference.