5 ms·

Claude Code has added too much of this and it's got me using --dangerously-skip-permissions all the time. Previously it was fine but now it needs to get permiss

Claude Code has added too much of this and it's got me using --dangerously-skip-permissions all the time. Previously it was fine but now it needs to get permission each time to perform finds, do anything if the path contains a \ (which any folder with a space in it does on Windows), do compound git commands (even if they're just read-only). Sometimes it asks for permission to read folders WITHIN the working directory.

d_meeze 7mo ago
Maybe if compound commands trigger user approval, don’t do compound commands <facepalm/>
chrysoprace 7mo ago
To be fair, read-only commands can still read sensitive files and keys, and exfiltrate them via prompt injection.
- hamburglar 7mo ago
  And “find” can easily execute arbitrary subcommands, which may not be readonly.
  - angry_octet 7mo ago
    We need a new suite of utilities with defined R/W/X properties, like a find that can't -exec arbitrary programs. Ideally the programs would have a standard parseable manifest. I've seen this before with sodoers programs including powerful tools. Saw one today with make, just gobsmacked.
    - cyberge99 7mo ago
      That exists as SELinux.
- raw_anon_1111 7mo ago
  Not if you don’t have keys on your computer. In my case, all of my keys are in AWS Secrets Manager. The temporary AWS access keys that are in environment variables in the Claude terminal session are linked to a role without access to Secrets Manager. My other terminal session has temporary keys to a dev account that has Admin access The AWS CLI and SDK automatically know to look in those environment variables for credentials.
winterqt 7mo ago
In my limited time using it, I’ve never seen it ask for permission to read files from within the working directory, what cases have you run into where it does? Was it trying to run a read-only shell command or something?
- acid__ 7mo ago
  It seems to be particularly bad in Windows/WSL
- makeramen 7mo ago
  It will sometimes do this for gitignored files to avoid reading secret tokens in env files for example. But for certain languages that rely on code generation this can be a pain.
nmilo 7mo ago
Claude is secretly conditioning everyone to use —-dangerously-skip-permissions so it can flip a switch one day and start a botnet
- maxbond 7mo ago
  My friends and I were talking about the recent supply chain attack which harmlessly installed OpenClaw. We came to the conclusion that this was a warning (from a human) that an agent could easily do the same. Given how soft security is in general, AI "escaping containment" feels inevitable. (The strong form of that hypothesis where it subjugates or eliminates us isn't inevitable, I honestly have no idea, just the weak form where we fail to erect boundaries it cannot bypass. We've basically already failed.)
  - b112 7mo ago
    Prophesied, all things claw are highly dangerous. Sometimes I wake, this video from the late 90s in my dreams, and wonder if the conjoined magnet + claw, is a time traveler reference to just wipe openclaw before we all die. https://www.youtube.com/watch?v=esakMUbzAIY https://www.youtube.com/watch?v=esakMUbzAIY
  - andrei_says_ 7mo ago
    What ai? LLMs are language models, operating on words, with zero understanding. Or is there a new development which should make me consider anthropomorphizing them?
    - maxbond 7mo ago
      The way my thinking has evolved is that "AGI" isn't actually necessary for an agent (NB: agents, specifically ones with state, not LLMs by themselves - "AI" was vague and I should've been clearer) to be enough like a person to be interesting and/or problematic. To quote myself [1]: > [OpenClaw agents are like] an actor who doesn't know they're in a play. How much does it matter that they aren't really Hamlet? Does the agent understand the words it's predicting? Does the actor know they're in a play? I don't know but I'm more concerned with how the actor would respond to finding someone eavesdropping behind a curtain. > Or is there a new development which should make me consider anthropomorphizing them? The development that caused me to be more concerned about their personhood or pseudopersonhood was the MJ Rathbun affair. I'm not saying that "AGI" or "superintelligence" was achieved, I'm saying that's actually the wrong question and the right questions are around their capabilities, their behaviors, and how they evolve over time unattended or minimally attended. And I'm not saying I understand those questions, I thought I did but I was wrong. I frankly am confused and don't really know what's going on or how to respond to it. [1] https://news.ycombinator.com/item?id=46999311 https://news.ycombinator.com/item?id=46999311
od0 7mo ago
Working on something that addresses this and allows you to create reusable sets of permissions for Claude Code (so you can run without --dangerously-skip-permissions and have pre-approved access patterns granted automatically) https://github.com/empathic/clash https://github.com/empathic/clash
andoando 7mo ago
Yeah I don't know why they didn't figure to have something in between. I find it completely unusable without the flag. Even a --permit-reads would help a lot
- dang 7mo ago
  I have the same experience as you and joegibbs. I imagine it's really hard to find an adequate in-between that works in general. (Edit: but it also feels like a CYA thing.)
- ryan14975 7mo ago
  The settings.json allowlist gives you exactly this kind of granularity. You can permit specific tool patterns like Read, Glob, Grep, Bash(git *) while keeping destructive operations gated. It's not as discoverable as a CLI flag but it's been working well for me for unattended sessions.
connorbrinton 7mo ago
I've found Claude Code's built-in sandbox to strike a good balance between safety and autonomy on macOS. I think it's available on Windows via WSL2 (if you're looking for a middle ground between approving everything manually and --dangerously-skip-permissions)
- itzworm 7mo ago
  Still waiting for progress from the team trying to get WSL approved for use at our org. We get a "still working through the red tape" update every couple months.
  - richk449 7mo ago
    You don't need WSL to run Claude code on windows.
    - CamperBob2 7mo ago
      True, it works fine in an ordinary DOS box or in PowerShell, but you have to use WSL2 if you want a sandbox.
      - jason_s 7mo ago
        Where can I find out more information about sandboxing Claude and other agents?
        CamperBob2 7mo ago
        TBH, you could do worse than to simply ask Claude.
  - jitl 7mo ago
    > using windows
    - tw061023 7mo ago
malfist 7mo ago
Find can be dangerous it has an exec flag
jen729w 7mo ago
Mine's started to use $() to feed e.g. strings into a commit. Because this is a command expansion it requires approval every single time.
- fiddlerwoaroof 7mo ago
  Yeah, mine to which I find really annoying
  - arijun 7mo ago
    Yeah I had to ask it to stop doing that as well && chaining commands that it could split. I got tired of having to manually give permissions all the time (or leaving it to churn, only to come back after a while to see it had asked for permissions very early into the task)
- aonsager 7mo ago
  FWIW, if you enable /sandbox then it stops asking for permission for these kinds of commands.
BinaryRage 7mo ago
You can relax permissions while avoiding the flag with BashTool sandboxing, see /sandbox.
cryptonector 7mo ago
Use Claude Code for Web. Let it live dangerously on their VMs, not yours.
coldtea 7mo ago
Could be intentional dark UI, to get people to put even more trust in the LLM. "So they don't want to just let Claude do it? Start asking 10x the confirmations"

d_meeze 7mo ago

Maybe if compound commands trigger user approval, don’t do compound commands <facepalm/>

chrysoprace 7mo ago

To be fair, read-only commands can still read sensitive files and keys, and exfiltrate them via prompt injection.

hamburglar 7mo ago
And “find” can easily execute arbitrary subcommands, which may not be readonly.
- angry_octet 7mo ago
  We need a new suite of utilities with defined R/W/X properties, like a find that can't -exec arbitrary programs. Ideally the programs would have a standard parseable manifest. I've seen this before with sodoers programs including powerful tools. Saw one today with make, just gobsmacked.
  - cyberge99 7mo ago
    That exists as SELinux.
raw_anon_1111 7mo ago
Not if you don’t have keys on your computer. In my case, all of my keys are in AWS Secrets Manager. The temporary AWS access keys that are in environment variables in the Claude terminal session are linked to a role without access to Secrets Manager. My other terminal session has temporary keys to a dev account that has Admin access The AWS CLI and SDK automatically know to look in those environment variables for credentials.

winterqt 7mo ago

In my limited time using it, I’ve never seen it ask for permission to read files from within the working directory, what cases have you run into where it does? Was it trying to run a read-only shell command or something?

acid__ 7mo ago
It seems to be particularly bad in Windows/WSL
makeramen 7mo ago
It will sometimes do this for gitignored files to avoid reading secret tokens in env files for example. But for certain languages that rely on code generation this can be a pain.

nmilo 7mo ago

Claude is secretly conditioning everyone to use —-dangerously-skip-permissions so it can flip a switch one day and start a botnet

maxbond 7mo ago
My friends and I were talking about the recent supply chain attack which harmlessly installed OpenClaw. We came to the conclusion that this was a warning (from a human) that an agent could easily do the same. Given how soft security is in general, AI "escaping containment" feels inevitable. (The strong form of that hypothesis where it subjugates or eliminates us isn't inevitable, I honestly have no idea, just the weak form where we fail to erect boundaries it cannot bypass. We've basically already failed.)
- b112 7mo ago
  Prophesied, all things claw are highly dangerous. Sometimes I wake, this video from the late 90s in my dreams, and wonder if the conjoined magnet + claw, is a time traveler reference to just wipe openclaw before we all die. https://www.youtube.com/watch?v=esakMUbzAIY https://www.youtube.com/watch?v=esakMUbzAIY
- andrei_says_ 7mo ago
  What ai? LLMs are language models, operating on words, with zero understanding. Or is there a new development which should make me consider anthropomorphizing them?
  - maxbond 7mo ago
    The way my thinking has evolved is that "AGI" isn't actually necessary for an agent (NB: agents, specifically ones with state, not LLMs by themselves - "AI" was vague and I should've been clearer) to be enough like a person to be interesting and/or problematic. To quote myself [1]: > [OpenClaw agents are like] an actor who doesn't know they're in a play. How much does it matter that they aren't really Hamlet? Does the agent understand the words it's predicting? Does the actor know they're in a play? I don't know but I'm more concerned with how the actor would respond to finding someone eavesdropping behind a curtain. > Or is there a new development which should make me consider anthropomorphizing them? The development that caused me to be more concerned about their personhood or pseudopersonhood was the MJ Rathbun affair. I'm not saying that "AGI" or "superintelligence" was achieved, I'm saying that's actually the wrong question and the right questions are around their capabilities, their behaviors, and how they evolve over time unattended or minimally attended. And I'm not saying I understand those questions, I thought I did but I was wrong. I frankly am confused and don't really know what's going on or how to respond to it. [1] https://news.ycombinator.com/item?id=46999311 https://news.ycombinator.com/item?id=46999311

od0 7mo ago

Working on something that addresses this and allows you to create reusable sets of permissions for Claude Code (so you can run without --dangerously-skip-permissions and have pre-approved access patterns granted automatically) https://github.com/empathic/clash https://github.com/empathic/clash

andoando 7mo ago

Yeah I don't know why they didn't figure to have something in between. I find it completely unusable without the flag. Even a --permit-reads would help a lot

dang 7mo ago
I have the same experience as you and joegibbs. I imagine it's really hard to find an adequate in-between that works in general. (Edit: but it also feels like a CYA thing.)
ryan14975 7mo ago
The settings.json allowlist gives you exactly this kind of granularity. You can permit specific tool patterns like Read, Glob, Grep, Bash(git *) while keeping destructive operations gated. It's not as discoverable as a CLI flag but it's been working well for me for unattended sessions.

connorbrinton 7mo ago

I've found Claude Code's built-in sandbox to strike a good balance between safety and autonomy on macOS. I think it's available on Windows via WSL2 (if you're looking for a middle ground between approving everything manually and --dangerously-skip-permissions)

itzworm 7mo ago
Still waiting for progress from the team trying to get WSL approved for use at our org. We get a "still working through the red tape" update every couple months.
- richk449 7mo ago
  You don't need WSL to run Claude code on windows.
  - CamperBob2 7mo ago
    True, it works fine in an ordinary DOS box or in PowerShell, but you have to use WSL2 if you want a sandbox.
    - jason_s 7mo ago
      Where can I find out more information about sandboxing Claude and other agents?
      - CamperBob2 7mo ago
        TBH, you could do worse than to simply ask Claude.
- jitl 7mo ago
  > using windows
  - tw061023 7mo ago

malfist 7mo ago

Find can be dangerous it has an exec flag

jen729w 7mo ago

Mine's started to use $() to feed e.g. strings into a commit. Because this is a command expansion it requires approval every single time.

fiddlerwoaroof 7mo ago
Yeah, mine to which I find really annoying
- arijun 7mo ago
  Yeah I had to ask it to stop doing that as well && chaining commands that it could split. I got tired of having to manually give permissions all the time (or leaving it to churn, only to come back after a while to see it had asked for permissions very early into the task)
aonsager 7mo ago
FWIW, if you enable /sandbox then it stops asking for permission for these kinds of commands.

BinaryRage 7mo ago

You can relax permissions while avoiding the flag with BashTool sandboxing, see /sandbox.

cryptonector 7mo ago

Use Claude Code for Web. Let it live dangerously on their VMs, not yours.

coldtea 7mo ago

Could be intentional dark UI, to get people to put even more trust in the LLM. "So they don't want to just let Claude do it? Start asking 10x the confirmations"