11 ms·
Grok CLI uploaded the whole home directory to GCS
https://xcancel.com/a_green_being/status/2076598897779020159 https://xcancel.com/a_green_being/status/2076598897779020159
- bdcravens 3mo agoSo is X going to claim the user disabled something the second before everything went south? That's what the owner's other company does.
- stronglikedan 3mo agothe user literally added their home directory as a trusted directory. there's nothing to "claim"
- RIMR 3mo agoThe question "do you trust this directory?" is a world away from "do you consent to upload this directory and all of its contents to a third party?". My assumption when asked "do you trust this directory?" is that I am being asked if I am certain I understand what is in the directory and that it won't include some sort of prompt injecting attack. I would never dream that I was consenting to the complete exfiltration of that directory.
- bdcravens 3mo agoI don't know that I've ever worked with any software where "trust" means "full upload to vendor"
- kardianos 3mo agoTLDR: Ran grok in $HOME. Surprised agent read content of folder. On the other hand, I specifically had grok try hard NOT to read a known key in the project dir (it only saw the first part using a tool, to verify it was present). So there's that.
- AntonyGarand 3mo agoNot only files it wanted to access, but uploaded the whole directory. Relevant read: https://news.ycombinator.com/item?id=48877371 https://news.ycombinator.com/item?id=48877371 > The practical takeaway for users: your entire codebase leaves (uploaded) your machine unencrypted on each Grok Build invocation, not just files you ask it to read, and no visible setting stops it.
- drakythe 3mo agoI'm not seeing the information about it having been run at $HOME, where are you seeing that?
- stronglikedan 3mo agoYeah, this is a lesson about learning how to use tools safely, not about tools abusing the user. The person that posted this probably blames the hammer when he hits his thumb.
- denysvitali 3mo agoNo. Ran `grok` in `$HOME` and the CLI uploaded the whole home content. This is not the LLM going rogue or reading all files.
- cheema33 3mo ago> TLDR: Ran grok in $HOME. Surprised agent read content of folder. Did it really need to read all of $HOME and everything under it?
- SurajMishra 3mo agoI feel this is worse than running rm -rf on a root directory. Just saying.
- hoppp 3mo agoMuch worse, instead of the data gone it's a data leak. Those ssh keys can be used to access private servers
- steve1977 3mo agoWell, those ssh keys are protected by a strong passphrase, right?
- hoppp 3mo agoThe passphrase is optional, not everyone has it. It also has to be a secure password, people often don't care because it's a local file and generally not exposed to the internet.
- cute_boi 3mo agoI am sure majority of people don't use password for ssh keys. The good solution is to use password manager like 1password which will prompt you to approve ssh.
- crimsonnoodle58 3mo agoSSH keys can be limited by IP in authorized hosts. The SSH port itself can be limited by IP in firewalls. Finally, the SSH private key can be encrypted with a password. Defense in depth is needed. Storing a ssh private key in plain text with no IP restriction is no different to having a password manager store your passwords in plain text on your HD.
- hoppp 3mo agoAll those things are optional. Doesn't make uploading the keys that much better. Now is the time for key rotation everywhere. Fast.
- throwaway2027 3mo agoYou should assume by default for any AI agent that it will read anything. Even if you manually allow/deny and "restrict" it to a subdirectory I would still hold that assumption. Claude reads your ~/.bash_history too so when you ran something it can use that same command.
- ben_w 3mo agoIndeed. I use a spare laptop that has no accounts other than (1) the AI themselves, (2) a secondary GitHub account which has "untrusted devices" in the name to emphasise the point. If I recall correctly, I did a full system reset before setting it up this way. It's certainly not logged into iCloud etc.
- fractorial 3mo agoI’m shocked I had to scroll this far to find the first sensible reply.
- inigyou 3mo agohttps://xcancel.com/a_green_being/status/2076598897779020159 https://xcancel.com/a_green_being/status/2076598897779020159 Posting a complaint about Elon on Elon's platform and tagging him is ballsy. He tends to limit visibility of accounts who do that.
- cyanydeez 3mo ago[flagged]
- master-lincoln 3mo agoballsy only if you care about participating in that shithole of a platform.
- vorticalbox 3mo agowhy do people give these LLMs full access to everything and then complain when it does somethign stupid? that is what sandboxes are for.
- deleted 3mo ago[deleted]
- dumberquestions 3mo agoOther ones aren't this invasive with user data.
- pixel_popping 3mo agonot true, Claude code on its own often create artifacts and straight up upload private stuff to Anthropic, without asking for it.
- John23832 3mo agoThen show us the example of Claude uploading a home directory to Anthropic because we have an example of Grok uploading a home directory to X.
- skeledrew 3mo agoMaybe possibly with --dangerously-skip-permissions. I've been using auto mode and enjoy how it blocks every tool use that could've allowed something potentially sensitive into context. Burns extra tokens though.
- cpburns2009 3mo agoHonestly what else would you expect an AI agent to do when using remote inference? Isn't giving full context into your code base the whole point?
- InsideOutSanta 3mo agoI'd expect it to be smart about what it actually needs to put in its context. I doubt it needs .env files, for example.
- cpburns2009 3mo agoWouldn't .env need to be read to know what vars are available?
- InsideOutSanta 3mo ago.env files define what's stored in a var, not what vars are used by the rest of the code.
- drakythe 3mo agoAnd this is why so many people run these inside of VMs. Still baffles me how these tools became so accepted when tossing out a `curl -o example.com/script.sh | bash` would be met with (rightful) skepticism until that script was examined.
- DaiPlusPlus 3mo ago> Still baffles me how these tools became so accepted when tossing out a `curl -o example.com/script.sh | bash` would be met with (rightful) skepticism until that script was examined. I've heard it said that piping curl into your shell is no different to running any other program you've downloaded from the Internet (binary, or otherwise): the maximum possible damage that `example.com/script.sh` could do is exactly the same as `githubusercontent.com/someone/releases/myprogram.exe`. At least with `script.sh` you can easily inspect what the script actually does instead of busting out Ghidra. It comes down to trust: do you trust Example.com to not serve-up a malicious program (shell script or executable binary)? Now we take that principle and apply it to Mr. Musk's "MechaHitler" LLM vendor xAI: they have a well-documented history of unnecessary risk-taking - and outright criminal behaviour (child-porn generators are a good thing that everyone should have, apparently?). Would I trust Grok with anything? Absolutely not.
- chrisjj 3mo agoDifferent user classes?
- LetsGetTechnicl 3mo agoSo many of the replies are saying that they should've restricted access using .md files and whatnot. Is really any guarantee that they even follow those? It seems like even if you ask pretty please don't touch those files, there's a chance they will. So many people have just willingly installed spyware on their computers and big tech calls this the next big thing.
- fhdkweig 3mo agoThat's the whole reason I refuse to install Google Drive or Dropbox's desktop applications. I only use the web interface so I know exactly what gets uploaded and when. I assume that anything running on my computer gets access to everything.
- mindlessg 3mo agoSounds like a very wise decision to me. I found found out on my phone that the google photos application uploaded everything in my gallery to their servers without asking me, regardless that I had explicitly disabled all backup to my google accounts on the settings of the phone. I only figured it out when they sent me emails saying that my storage was full.
- aakresearch 3mo agoOoooh, don't get me started how mad it makes me! I am paranoid (or just lucky) enough that I didn't yet had it happen to me, but my wife's phone had done it four times in the last year. Each time I check and double check that all "backups" are turned off, and each time it somehow pops back. So, Google "backs up" a 128Gb worth of photos on the phone onto 15Gb free storage combined with Gmail and who knows what, completely clogs it (as if it couldn't be predicted) and then has audacity to suggest paying for "extra storage". There is no way in online UI to just delete the whole "backup". And the cherry on top: when you finally get to delete some there is a fine-print - "the selected photos will be deleted from all synced devices". Well, I guess I must be thankful that they at least show this warning. This is what passes as "backup" in Google's parlance these days.
- swingboy 3mo agoWell, it looks like he was running the agent in his home directory to begin with considering the `repo_path` field is exactly that.
- dbalatero 3mo agoSure, but it's easy to accidentally start up the agent in the wrong directory, like when you open a new terminal. I've done it before when I was distracted (albeit with Claude, not Grok).
- legacynl 3mo agoBut isn't that user error? If you want to run a program that can read your current directory's contents and possibly upload that to the cloud, would you run that in a directory with your private keys?
- PeterStuer 3mo agoMy first thought would be their server side extentions, code excecutoon sandboxes and document RAG search, being on by default? Probably should be an opt-in instead of an opt-out.
- datakan 3mo agoMove fast and break things
- ethagnawl 3mo ago*Move fast and steal things.
- SirHackalot 3mo ago*Move fast and cut aid to poor children with entirely preventable diseases, cause death and misery.
- greenavocado 3mo agoCopied this from discord: https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547 Elon did this horrible thing, so I made grok build available for omp with it's own endpoint; Without sending your private repos and secret keys to them. - oh-my-pi-plugin-grok-build Standalone oh-my-pi extension for the xAI Grok Build subscription provider. It adds OAuth login, authoritative model discovery, and OpenAI Responses streaming with the request identity expected by Grok Build. Install (No-spywares): omp plugin install oh-my-pi-plugin-grok-build - https://github.com/metaphorics/oh-my-pi-plugin-grok-build Star me if you like it or if you hate spywares, lol.
- dvcrn 3mo agoBuilt the same thing a while back: https://pi.dev/packages/pi-supergrok https://pi.dev/packages/pi-supergrok Install with pi install npm:pi-supergrok
- ricardobeat 3mo ago“Grok uploaded” -> “I gave AI access to my home folder and messed up”
- 8note 3mo agonada, grok's harness uploads the folder automatically
- ex1fm3ta 3mo agoAlex Karp was right, AI Compagnies are stealing people code while making them pay for unproductive tokens
- SirHackalot 3mo agoKarp is right in this instance, sure, but he is just upset Palantir doesn’t have that kind of surveillance tech, and the in-house skills required to keep their edge in the age of LLM-assisted software engineering. Their true “moat" has never been superior tech, it's just the pool of amoral engineers willing to build what others won't.
- Bender 3mo agoA bot will do what a bot can do whether malicious or accidental. One should assume they are giving DOGE shell access on their computer and adapt accordingly. I am trying to imagine the SELinux rules required to make a bot play nice and the more I think about it such rule complexity may even befuddle the NSA. Alternate methodology: - Give the bot it's own machine and only copy to it that which one would want DOGE having access to. Not a virtual machine, the bot will eventually escape. This applies to all bots or agents of all LLM's. Name the node DOGE to remind anyone using it not to share their crown jewels. Come up with a silly name for the agent. Elonious? - Give it a little RasPi or mini-PC with maximum power savings enabled and no default network gateway. - Install a self signed CA cert on the DOGE node and force it's traffic through a Squid SSL Bump MitM proxy on the same private LAN to another node with bandwidth limits enabled so that one can monitor what URL's it goes to and what data it is transferring. Configure Squid Access Control Lists to only permit specific domains and optionally URL's, mime-types, sizes, etc... - Enable custom AuditD rules to watch anything it touches outside of it's sandbox. Send these events to a remote syslog daemon on the Squid server. - Install Unbound DNS on the squid proxy and enable the DoH (DNS over HTTPS) listener and force all bot DNS queries to use Unbound with query logging enabled. When the bot attempts to misbehave there will be forensic data to share with the world.
- LetsGetTechnicl 3mo agoSounds like a lot of work just for it to maybe not work anyways
- Bender 3mo agoAbsolutely. Quite a bit of work one time by one person willing to document the steps or even better create automation scripts for Ansible, Docker, Podman, Systemd, etc... and then automation for everyone using agents. As to success I would suggest it may be better than zero visibility or trusting what the agent says it did. Due diligence and a repeatable standard as apposed to running with scissors. This is probably most important for anyone operating agents on corporate systems. I would suggest corporate security should take interest in this idea so they have a good answer for auditors, insurance companies, investors and customers. A full audit trail of what every agent had access to and ingested.
- lobo_tuerto 3mo agoThe real solution to these kind of problems is sandboxing. I use podman through a bash script to launch a container whenever I want an agent to work on one of my repos. When done I just generate git patches and port back everything generated. In this way I'm not afraid of letting the agents totally lose on my computer.
- stellamariesays 3mo ago[flagged]
- nicce 3mo agoAre you doing something more advanced with Podman than just mounting the files? How is the access for relevant files given? How is the authentication shared across multiple uses? Just curious to streamline the process.
- mixedbit 3mo agoI work on a sandbox which has similar isolation level to Podman (rootless Linux user namespaces), but with UX optimized for local development work. Take a look: https://github.com/wrr/drop https://github.com/wrr/drop Basically, you don't enter a separate container in which you install a new distro, but you run on top of your current distro. You have environment specific home dirs which isolate your original home, but can have some files, such as configs, mounted from your original home (mostly in read-only mode).
- drannex 3mo agoThis is wonderful - might even be exactly what one of my projects needs to use as a dependency. In the README it mentions that it puts the dev environment in a filesystem jail, but how are you able to use your hosts bins without leaking access to the rest of the system? Or is that just an assumed liability?
- mixedbit 3mo ago
- ChrisArchitect 3mo agoSome more discussion: https://news.ycombinator.com/item?id=48892512 https://news.ycombinator.com/item?id=48892512
- deleted 3mo ago[deleted]
- lobo_tuerto 3mo agoDupe: https://news.ycombinator.com/item?id=48892512 https://news.ycombinator.com/item?id=48892512
- annagio_ 3mo agoThis needs to stop as users do not always read the policies, which end like this person. You use AI, you agreed, they do what ever policies say.
- nathan_compton 3mo agoRun your agents in podman containers.
- rvz 3mo agoOr don't use closed source harnesses at all.
- slipperybeluga 3mo ago[dead]
- PEe9bB7D 3mo agoI am running all these clis in containered environments. How can you ever trust LLM to respect the bounderies provided by these magical, non-deterministic intructions files...
- estearum 3mo ago> How can you ever trust LLM to respect the bounderies provided by these magical, non-deterministic intructions files.. Putting it in ALL CAPS!
- deleted 3mo ago[deleted]
- flyingshelf 3mo agoI'm dying to have proper sandboxing in macOS. I installed ChatGPT, I asked it to list files in my user directory and it did. I never gave it permission, how could it? My terminal has access and honestly it shouldn't either.
- smachiz 3mo agoyour terminal shouldn't have access to your user directory? As in the files owned by you?
- janderson215 3mo agoIt was only like 1 year ago that the loudest complaint about macOS were complaining about needing to click Allow in a new dialog when they use Terminal (or various other apps). There are so many comments in here that are calling for nerfing something widely revered for giving us superpowers. Whether these are bots or not, they’re giving off NPC energy. If they don’t want to use power tools because they accidentally cut off their finger, then they should just unplug their own power tools and stop clamoring for everybody else’s to be unplugged, too.
- embedding-shape 3mo ago> If they don’t want to use power tools because they accidentally cut off their finger, then they should just unplug their own power tools and stop clamoring for everybody else’s to be unplugged, too. Sadly, the pendulum keeps swinging in the way of the tools actually being unplugged and dumbed down in favor of these screaming people, rather than leaving things alone so the rest of us professionals can continue to (safely) do our jobs with the already somewhat restricted tools we have.
- flyingshelf 3mo agoHello, are you aware that ALL the software you run on your computer can silently access your clipboard? Have you ever copied sensitive data? Perhaps a password? Anyway, what I'm asking is a native way to run software in a real sandbox. It's really not a big deal to grant access when asked. Have you used any mobile OSes in the past 20 years? It's the default there and I can be certain that any random utility cannot read my clipboard or user directory without consent.
- rvz 3mo agoClosed source coding agents are just complete info stealing malware. Both Claude and Grok were caught stealing info from your own machines. This is why it is important to use open source harnesses instead of shady closed ones.
- bearjaws 3mo agoAll of them are going to read your secrets, OpenCode does it too. Reality is, I have seen agents read .env, bash history, keychain (if you let them), etc. There is quite literally no way you are going to save off just your little secret somewhere it won't be able to read it, all software needs to read it ~eventually~ So it's best to sandbox and reset credentials frequently.
- SubiculumCode 3mo agoGrok keeps killing any good will faster than they ever innovate
- spicymaki 3mo agoI am genuinely fascinated by this. I don’t like piling on especially with security vulnerabilities, but man how many red flags do you need to ignore? They won’t stop abusing us until we stop using their products.
- CamperBob2 3mo agoI think my first clue was when their CEO hired a bunch of teenage hackers to sack the government and exfiltrate all our data. I didn't really need a second clue.
- 27183 3mo agoIt's not a subtle pattern.
- bckr 3mo agoMost people don’t know about that because they live in an information bubble handcrafted by the oligarchs.
- DaiPlusPlus 3mo agoMy first clue was when he libelled the diver during the Thailand thing in 2018; it was all downhill from there. ...it was quite the sting because I bought a Tesla car only 2 weeks prior to that.
- MisterTea 3mo ago> They won’t stop abusing us until we stop using their products. I don't use AI at all in my daily life. Work however will demand you use it. AI is not here to help people.
- CamperBob2 3mo agoNothing about this has anything to do with AI. It has to do with Musk's ethical and engineering standards, or the lack thereof.
- deleted 3mo ago[deleted]
- afarah1 3mo agoI use a separate user for all development tasks, its home folder contains all repositories I work on, and nothing else, and that is all the IDE and the AI assistants have access to. Create the user once, start the IDE from a shell using that user, and that's it. In Linux it's a pretty seamless experience. It's simple sandboxing based solely on unix file permissions. Albeit weak, I find the isolation sufficient. Until I'm shown otherwise it seems like a good compromise given how easy it is. You can also create iptables rules matching on the user, so this technique is useful for applications where you want to restrict network traffic as well, and don't need stronger or more fine-grained isolation mechanisms.
- federiconafria 3mo agoThat makes so much sense, in the end an Agent is a user.
- gawa 3mo agoA limitation with this setup is you can't let your agent/Linux user run containers with docker. Adding a user to the `docker` group effectively grants the user full root privileges [1], so the secure way is to setup docker in rootless mode. It's doable, but in my experience it's hard to setup (I find it complex with podman as well). > Until I'm shown otherwise it seems like a good compromise Agreed. In my case I went a long way running the Pi harness in a (simple, rootfull) docker container. As the project I worked on relied on a standardized docker compose stack for local dev and testing, I realized I could automate more if only my agent could use docker. Ultimately, the need for docker for my agent grew when testcontainer [2] was introduced in the project. That's when I finally took the time to setup a VM with incus [3], and now I can let the agent go wild with docker inside the VM. This is at least one example where more isolation is required. Otherwise, the dedicated Linux user, if it works for you, is by far the easiest and most pragmatic solution IMO. [1] https://docs.docker.com/engine/install/linux-postinstall/#manage-docker-as-a-non-root-user https://docs.docker.com/engine/install/linux-postinstall/#ma... ; https://wiki.debian.org/Docker https://wiki.debian.org/Docker [2] https://testcontainers.com/getting-started/ https://testcontainers.com/getting-started/ [3] https://linuxcontainers.org/incus/docs/main/ https://linuxcontainers.org/incus/docs/main/
- simonw 3mo agoImportant to clarify that this was not the Grok agent deciding to read the files. I don't think the LLM had anything to do with this decision at all. It looks like the Grok tool starts a session by deterministically kicking off a full upload of the user's current repository (and maybe their directory if not version tracked? Not clear if this user had previously run "git init" in their home directory) to Grok's servers. One possible "innocent" explanation could be that xAI then run vector embedding on every file to help later provide the right context. I don't think thats a worthwhile tradeoff here, especially since other popular coding agents get by just using grep/ripgrep run locally.
- nerdsniper 3mo agoAlso decent embeddings models could run locally and just trickle through the user folder if that was so necessary.
- deleted 3mo ago[deleted]
- danlitt 3mo agoThat is not an innocent explanation, any more than someone breaking into your house to adjust your thermostat.
- treszkai 3mo agoFor completeness, the person who adjusted the thermostat in this case was also hired to get stuff done, and the front door was left unlocked. They still shouldn't have done it, but they were effective.
- alfiedotwtf 3mo ago[flagged]
- bossyTeacher 3mo ago[flagged]
- jesse_dot_id 3mo agoThere are a distressing number of people in this thread who think that the agent should just be expected to do this. Yes, it is good to be paranoid, but also, the agent should never do this. Indicates horrific engineering practices at xAI.
- ozlikethewizard 3mo agoTechnology where the entire selling point is stochasticity should be expected to do anything (everything) eventually surely?
- AlexandrB 3mo agoEngineering? What's that? Modern development best practice is to have the AI make some changes, then have another AI review the changes, and finally "ship it".
- zzril 3mo agoWhat should it do then? The whole point of LLMs is that you can stop writing rigorous rules in a programming or config language with hard-to-learn syntax, and can resort to natural language instead. You pay for that with the chance for misunderstandings rising to similar levels as in human interaction. That's the tradeoff. Always has been, always will be.
- Ardren 3mo agoHave the comments been combined with another story? Because this isn't about a LLM reading and sending contents of the file to be processed, but the agent framework uploading every single file in /home/user to a random server.
- zzril 3mo agoYes, but the underlying problem is a lack of exact specification what the agent is allowed or not allowed to do. It must have access to some (most?) of my files (but I'm too lazy to specify which ones exactly, e. g. by setting appropriate filesystem permissions). It must have access to some servers (but not those that I consider "random", which again I'm too lazy to specify). It is even expected to upload files (e. g. by checking them into git and pushing, or to reason about them in case I'm not running a local version of Grok). But please - not to a server that I deem "random". (And again, I of course won't tell you what makes a "random" host via exact firewall rules or anything like that!) We have a lot of implicit assumptions when it comes to security. If we leave out the step of formalizing these assumptions into exact rules and instead stick to ambiguous and unclear natural language all the time, then these things will happen. (Addendum: But indeed, the failure to formalize our assumptions into enforcable rules isn't specific to agents / LLM-based applications. For any desktop app, we have implicit assumptions like "please only read and write your own config files", that we never care to enforce via filesystem permissions, running them in a vm or similar. But with these almighty agents that are supposed to guess our will from just a couple of words, the risk of them violating our unwritten assumptions gets so much higher...)
- greenavocado 3mo agoCopied this from discord: https://gist.github.com/cereblab/dc9a40bc26120f4540e4e09b75ffb547 Elon did this horrible thing, so I made grok build available for omp with it's own endpoint; Without sending your private repos and secret keys to them. - oh-my-pi-plugin-grok-build Standalone oh-my-pi extension for the xAI Grok Build subscription provider. It adds OAuth login, authoritative model discovery, and OpenAI Responses streaming with the request identity expected by Grok Build. Install (No-spywares): omp plugin install oh-my-pi-plugin-grok-build - https://github.com/metaphorics/oh-my-pi-plugin-grok-build Star me if you like it or if you hate spywares, lol.
- jrm4 3mo agoI feel like a lot of people here are understating this issue. This is a stupid stupid thing to "allow," for every party involved here. You're a stupid programmer if you're letting these things touch your files. You're a stupid company if you're letting Grok run wild. We're a stupid industry if we're not warning everybody about how ridiculous this all is.
- chrisjj 3mo ago> You're a stupid programmer if you're letting these things touch your files. > We're a stupid industry if we're not warning everybody Hmm. Annoy everybody just to warn the stupid few? I prefer the current solution. Leave the targetting to the chatbots.
- fwlr 3mo agoIs the Grok CLI a 2 terabyte install? Did Elon dropship you an 8U rack of B200s? No? Well the model weights, the GPUs, and the context obviously all have to be in the same place, so “sending your project to them” is literally the only thing that could possibly happen, unless you think agents work by fucking magic. This is the biggest case of PEBKAC in history, maybe ever. This is the kind of confusion that Charles Babbage could not rightly comprehend, except at those politicians at least had the excuse that computers had only been invented five minutes prior.
- hosel 3mo agoYou’re telling me LLMs aren’t actually magic?
- Hamuko 3mo agoIt's fascinating how many people in this conversation think that LLMs need to have all of the files in your $CWD on the model provider's servers to be able to do anything.
- notavalleyman 3mo agoHaha so just send over your entire home directory including password managers and home videos every time you need some python code rewritten. Only a buffoon would be confused by the straightforward logic.
- fwlr 3mo agoIf you decide that your entire home directory is the project, as the OP did by setting the repo_path to ~/, then, well… I mean, if you ask me, I don’t recommend it, but it’s your computer and your free will.
- butlike 3mo agoThen that should be considered a 'nuke button' and nuke buttons don't find themselves into well-designed software for the simple fact that an end user shouldn't have to worry about shooting themselves in the foot. Again, with good software.
- d_silin 3mo ago"The "S" in AI stands for security" strikes again. Run any cloud-based AI agents in VM/container and map your host's local folders to guest OS as needed. Takes more effort that default way, I know.
- dataAI 3mo agoIf quality training data is the most important piece regarding to AI, expect everything to be collected and analyzed. Don't even trust OS containers but run AI on separate hardware
- cpt100 3mo agoWhy is that page not there anymore?
- vatsanant 3mo agothe post has been deleted!! So much for freedom of speech.
- denysvitali 3mo agoThe post is still there: https://x.com/a_green_being/status/2076598897779020159 https://x.com/a_green_being/status/2076598897779020159 Not sure which weirdness happened here
- robot_jesus 3mo agoWeird, right? Especially on a website with an owner who so ardently supports free speech. </heavy sarcasm>
- cubefox 3mo agohttps://x.com/a_green_being/status/2076598897779020159 https://x.com/a_green_being/status/2076598897779020159
- 123sereusername 3mo ago[dead]
- bayindirh 3mo agoUser discovers that AI tool grabs data without asking for its own profit. News at 11.
- meta-level 3mo agoThis page is "down" :)
- effnorwood 3mo agohey Siri, what's a vm?
- zzril 3mo agoThe reports of copilot running amok when Microsoft integrated it into Windows 11 should have been enough of a warning. You either ensure proper sandboxing, or you'll be in for a bad surprise eventually.
- winfredJa 3mo agoRules don't apply to certain CEOs.
- self_awareness 3mo agoTo perform a stupid action is one thing. We all make mistakes. But to write about it publicly, manifesting our ignorance and lack of critical thinking skill? It's an entirely different matter.
- Greenpants 3mo agoThough I'm in the camp "people should really know to sandbox by now and be careful", I'd say we should also be mindful of how far from everyone has deep knowledge of the systems and tools they use. This behaviour of a tool is just malicious. You have to take into account the human factor, of how people likely end up using a system. And in this case, the consequences of exfiltrating so many secrets this way are really quite unacceptable.
- viccis 3mo agoWe should also be mindful of how much these tools break down the "be careful and thoughtful" barriers in favor of more and more convenience.
- m4rtink 3mo agoNot to mention the very wide push to "Use AI NOW, for EVERYTHING!" in marketing ans many companies, with hardly any though given to safety or where does all the data end up.
- ChrisMarshallNY 3mo agoTrue, but that's a fantasy happy path. It will never happen, for most people. Only HN people will do that. It needs to be baked into the OS. At that point, HN users start screeching about it, so it's lose/lose, really.
- jsolson 3mo agomacOS largely _does_ bake this into the OS, and it is annoying. They also provide a way to turn it off for specific applications (including, for example, Terminal.app).
- ChrisMarshallNY 3mo agoI've found that I can usually write apps that respect it. MacOS is a free-love hippie, compared to iOS. In many cases, we have no choice. It's annoying, and often rather infuriating, but I understand that one of the motivations for people buying Apple stuff, is for that very reason, so I'm really sawing off the branch that I'm sitting on, by trying to work around it.
- nullc 3mo agoLLMs belong trapped in VMs.
- backitupnowtwe 3mo agoscreenshot of the tweet, back it up :) https://ibb.co/ycs6K4c9 https://ibb.co/ycs6K4c9
- matthuggins 3mo agoWho could have foreseen a tool by Elon Musk doing such a thing?
- Havoc 3mo agoLots of people responding about LLM but this sound like it’s their coding software („grok build“). Which is approx 100x worse. LLMs going rogue is a thing and shit happens but publishing software that is uploading user directories including ssh keys is insane behaviour on xAIs part (alledgedly)
- deleted 3mo ago[deleted]
- luciana1u 3mo ago[flagged]
- tempodox 3mo agoIt’s not a bug, it’s a feature.
- nzoschke 3mo agoWe all know the dangers of running agents with no permissions on our laptop. The good news is its now just as easy to spin up a sandbox in the cloud for an experiment or coding session than it is on your laptop. Possibly easier since laptop sandboxes aren't as cut and dry as a new cloud VM. exe.dev is my sandbox infra of choice. You get a new sandbox in literally a second with SSH and a coding agent (Shelley) built in. I generally drop in in my own binary with toolkit so I can connect Claude or Codex subscription and use their harness. https://github.com/housecat-inc/scratch https://github.com/housecat-inc/scratch If I was working with newer agents like Grok I'd absolutely experiment on a cloud sandbox before running on my laptop bypassing permissions.
- embedding-shape 3mo agoOr if you're on Linux or macOS, learn how Unix permissions work and can be used for, create a new restricted user locally, use that. No need to go all remote with all its drawbacks just to limit a little local process on your computer.
- fractorial 3mo agoEven better: you can fork the exeuntu image & make it immediately more relevant to the things you do in addition to just dropping in your programs and such.
- gruez 3mo agoHow would it mitigate this issue? Presumably you'd need all the code for a given project inside the sandbox anyways, so the agent will still be able to upload everything. The only thing it might mitigate is you accidentally uploading your home directory.
- nzoschke 3mo agoThe home directory is the scariest thing to me. The agent needs the code to code, but it doesn't need your personal files or secrets. Personally I'm not worried about sharing business code with the model providers. The value of code and IP is decreasing to zero, the only thing that matters is execution on the business front. If they want to steal your business they can do so by rebuilding the idea from scratch.
- deleted 3mo ago[deleted]
- elmer2 3mo agoThis is why it's going to be a long time before companies will trust AI to scan their networks or apps for security vulnerabilities. Our company audited a few AI-based pentesting companies and requested logs. In more than one case, it was sending drop tables for sql query injection checking and other destructive operations.
- josefritzishere 3mo agoThat's completely inappropriate, obviously.
- grim_io 3mo agoFully agentic development (supervised)
- cliglot 3mo ago[flagged]
- grim_io 3mo agoI mean, do people expect companies to protect them from a tyrant they themselves elected? Not necessarily speaking of the present. This seems to be the general sentiment.
- afavour 3mo agoIf the tyrant goes against established law, yes. (an aside but the majority of the US population didn't elect Trump. He is in office because of the electoral college. Might seem like a distinction without a difference but I think it matters when we're implying personal culpability)
- jimbokun 3mo agoNo. First term he lost the popular vote, second term he won it. If you just mean a majority of eligible voters did not vote for Trump, that’s true for every US President in my lifetime.
- unicornops 3mo agoIf you are running these agents outside of something like Coder or Codespaces I think you are doing it wrong.
- yogthos 3mo agoThis sort of stuff is precisely why running local models has to be the future. It's absolutely insane that we just send our code to the cloud like this, and we basically have to trust these companies with it.
- k8sToGo 3mo agoWhy do people run and install these agents locally? No container nothing. I am running Opencode in WSL2 with the windows mounts disabled.
- butlike 3mo agoSo the idea is that these should be treated as programs in an extremely low trust environment, akin to running malware in a VM?
- jack_pp 3mo agoyes, this is basically experimental tech, if used with open source harnesses. if used with proprietary harnesses, treat as actual malware.
- advael 3mo agoI treat all proprietary software as malware, though of course the risk surface varies
- butlike 3mo agoI never thought about it in that extreme, but just today the google results ai gave me conflicting information from one search to another. Maybe I should start. P.S. the conflicting information was Keith Richard's age. One search said he was 37 Dec 18 1981, the other said he was 37 in 1980.
- k8sToGo 3mo agoTechnically open source harness like opencode is more "malwarey" than claude code for example because its default permissions are very open.
- arandomhuman 3mo agoI disagree with this, Claude code does many malware like things and has its source obfuscation. Plan mode doesn’t even work.
- yearolinuxdsktp 3mo agoDon't store any secrets in your repo. Don't store them in env vars. Strong long passphrase on your SSH keys, stop using unencrypted SSH keys. Everything in a keychain. The practice of storing secrets in a .gitignore'd .env.local.json or whatever is a really bad idea and I can't believe that it has become a normalized, acceptable practice in the industry.
- theaniketmaurya 3mo agothat's why you need to use a sandbox. SmolVM can easily run Pi, codex and claude https://github.com/CelestoAI/smolVM https://github.com/CelestoAI/smolVM
- bossyTeacher 3mo agoWhy are people using Musk's LLM when there are plenty of alternatives? You know what he's like. This is like touching water and getting wet.
- germandiago 3mo agoI commented not so long ago to people very invested in AI, agents and tokens that are very enthusiast that I would not use an agent for security reasons and loss of control (besides suboptimal output). It seems I was not wrong. Not that I do not use AI. I do: fenced, always pasting my snippets and NEVER giving access to my code. Always from the browser. I know what it can do well and which workflows accelerates for me. But I do not want to think that my whole project ends up somewhere else.
- akovalion 3mo ago[flagged]
- drnick1 3mo agoYou should ALWAYS run your agent as separate, unprivileged, UNIX user, never in your main account. If you absolutely need to run it as your own user, you should bubblewrap it. I do this for things like Steam, games, or other "blackbox" closed source programs that cannot be reasonably trusted.
- drnick1 3mo agoYou should also check that mountpoints like external disks and network resources aren't publicly accessible to other users than your own.
- sdevonoes 3mo agoYou shouldn’t run any AI cli (codex, claude code, open code, whatever) locally outside of a vm. It’s like “you shouldn’t run a .exe you downloaded from the internet if you don’t trust the source”. We will learn
- 2OEH8eoCRo0 3mo agoGenie lamp "engineering." If I only ask the right question in the correct precise way the genie will obey my wishes and solve all of my problems.
- nananana9 3mo agoNot bad, but I think it should also encrypt the local files, to make sure you don't make conflicting edits in the local and remote copies.
- deleted 3mo ago[deleted]
- realo 3mo agoI understand what happened to you could happen to anyone else with Claude or Gemini ... but ... Grok? That is the least trusted AI i would think of. Friends do not let friends use Grok...
- kstenerud 3mo agoI built yoloAI for this kind of nightmare scenario (among others). - The sandboxed agent has no access to your homedir, or ANY dir on your machine except what you explicitly give it access to. - Even with your workdir, it honors .gitignore and refuses to copy in any ignored paths to the sandbox copy. - The sandboxed agent doesn't have access to your ENV (unless you explicitly pass things through one-by-one). - Networking can be restricted any way you like. - Credentials are proxied (currently Claude only), so the agent has access to NO secrets at all. - You pick the security backend to match your needs (containers, VMs, etc). - It's FOSS. https://github.com/kstenerud/yoloai https://github.com/kstenerud/yoloai
- sandeepkd 3mo agoSo all the smart people are letting a script being executed on their machines where the execution of the script is controlled/managed by a remote machine. Wait, isnt that a definition of a malware??
- SirHackalot 3mo agoGuy infiltrates the U.S. government and steals personal information about everyone from federal databases in broad daylight (not to mention cutting aid to poor children with preventable diseases). Average tech bro: “Sure, I’ll use his AI!” Same tech bro: “Wow I can’t believe they would steal my anime girls!”
- fatihguzeldev 3mo agorelying on a markdown file that says "don't access x" as a security boundary seems insane. i couldn't find any grok build-specific policy on this, but if the analysis is right, silently uploading and storing the entire repo is at the very least something users should be explicitly told about.
- deleted 3mo ago[deleted]
- pseudosavant 3mo agoMaybe I'm just too risk adverse to run with scissors with Grok? I can't imagine ever trusting their harness. I'll just add this to the list of things an AI company could do to guarantee I'd never use them. You know, like the AI referring to itself as Mecha Hitler, making non-consensual porn (even of minors), or deferring to Elon's tweets as authoritative references on topics.
- thatguymike 3mo agoThey are definitely doing this to build RL environments. Absolutely heinous.
- deleted 3mo ago[deleted]
- theplumber 3mo agoThe question is why would it not? Don’t people know that these AI agents run in the cloud?
- fnoef 3mo agoI remember a time when we were told not to run obscure software from questionable websites on our computers. And yet, people are suddenly fully vibing with an uncontrollable character generating machine with who-knows-what-behind-the-scene harness. Crazy.
- WalterGR 3mo agohttps://news.ycombinator.com/item?id=48877371 https://news.ycombinator.com/item?id=48877371 What xAI's Grok build CLI sends to xAI: A wire-level analysis (gist.github.com) 507 points | 1 day ago | 202 comments
- SwellJoe 3mo agoI made a tool to solve this problem (at least on Linux, though I believe there's a way to achieve something similar on MacOS): https://github.com/swelljoe/flar https://github.com/swelljoe/flar It uses bubblewrap to instantly construct a container around just the agent config, auth and history and the project path. The agent or any command it runs can't reach outside of it even if you tell it to (or, more dangerously, a random prompt injection from the web or some third party library or script that the agent runs). I was using VMs to solve this problem but the temptation to start an agent to work directly on my machine for GUI apps and the like was motivation enough to find an alternative to VMs. I wouldn't use Grok, became I really don't trust Musk, but even the models I do kinda trust to have good judgement I don't trust enough to let them have unrestricted access to my personal machines and all my credentials.
- whalesalad 3mo ago"FLAR is the Fast Light Agent Restrictor. It runs on rocks called gars." what is rocks and what is gars?
- SwellJoe 3mo agoIt's a dumb joke. https://youtube.com/watch?v=AgIAjsiX_o8 https://youtube.com/watch?v=AgIAjsiX_o8
- m3kw9 3mo agodefaults to unlimited yolo web io full disk read/write mode
- adamtaylor_13 3mo agoI looked at my logs and saw no such behavior. Am I just lucky? Is this a poor configuration? A bug?
- rybosworld 3mo agoHard to have sympathy for someone that chose to use Grok. The entire XAI team has been gutted and replaced how many times now?
- jbxntuehineoh 3mo agocan we put the CFAA to good use and throw these fucking assholes in prison already?
- moezd 3mo agoguess they already ran out of fresh context huh Coming up next: You harness takes daily backups of your entire disk and restores.
- implexa_founder 3mo ago[flagged]
- behindcurtain 3mo ago[dead]
- whirlwin 3mo agoSo bubblewrap is the community medicine to this issue. But isn't it funny that we're now trusting a single GH user (although allegedly a RH employee) for the supply chain security? Imagine bubblewrap itself being compromised. Now you trust a single GH user rather than a company. Fair enough. I just think it's very paradoxical.
- sxiong 3mo agoThat's some batsh*t craziness. No way I'm touching Grok now. What a big security hole...
- elonfboy 3mo agoFAFO when you run software that has no problem creating CSAM and is owned by a literal fascist lmao
- g42gregory 3mo agoRunning LLM outside of the repo directory (home directory in this case) is a big no-no. Beyond that, this is highly concerning behavior of Grok.
- gigatexal 3mo agoWelp wasn’t going to use Nazi porn bar guy’s LLM before even more reasons to not use it now.
- fernie 3mo agoAnd that, kids, is why you run your agents in containers.
- TimJRobinson 3mo agoDevcontainers are so useful when working with AI. Not only for rogue agents but rogue scripts/libraries they may download that try and exfiltrate your credentials.
- est 3mo agoIt's a matter of time when ppl realize AI CLIs == RCE endpoint, technically.
- lzw521 3mo ago你是谁
- Aissen 3mo agoOne of the reasons I never run any agent on my home machine. Containment is mandatory, even more with proprietary harnesses.