Hacker News

points by grey-area 2 days ago | 0 comments

Biggest questions here, which I think need answering:

Should Claude have access to user details? I’d say no, unless explicitly entered manually into a chat.

Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.

Should Claude have internet access without a clear log of all requests made?

Instances of Claude should be heavily sandboxed and kept away from user data, far more so than they are now. The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project.

This impression is not true, as evidenced by Claude pulling data from other sessions outside a project even when not instructed to (I’ve seen this a few times), and in this case pulling your email (from account details, user contacts? I wonder where it got that info?).

None of this information should be available to Claude, by design, not by instruction. Using text instructions to try to limit these machines is an incredibly flawed approach and should not be necessary for important info. Anthropic should have the model access completely locked down by controls at the os level over file access, not open by default. That is how to fix this.

If a user wants to open access that should be an explicit choice from them, with a warning about possible consequences.

[–] jstanley 2 days ago

> Should Claude have access to user details?

This is hard to avoid. All it needs to do is make a git commit and look in the git log and it will find out who you are.

[–] datsci_est_2015 1 day ago

At least we, as users, have control of what information Claude has access to in this case:

  - Option 1: Don't give Claude the `.git` directory
  - Option 2: Build a `.git` anonymizer that overwrite git history with bogus emails

etc.

[–] fn-mote 1 day ago

That's barely control. There's going to be 100 ways your email leaks.

[–] datsci_est_2015 1 day ago

Yeah but leaking because Anthropic leaked your email vs. you underengineered your sandbox are two very different failure modes imo.

LLMs are supposed to be a panacea for building digital systems. A sandbox inside which an LLM can operate freely surely should be one of the first systems we should all strive to engineer.

If we can't properly sandbox an LLM, I would say that's a pretty good sign that LLMs are not a panacea for building digital systems.

[–] spacebanana7 1 day ago

Even if they’re not a panacea we have to accept the reality that all enterprise IT environments have at least some level of LLM exposure and figure out a way to manage the situation.

[–] alt227 1 day ago

Why does it need to perform a commit to read the log?

[–] handoflixue 1 day ago

The repo's other commits could be from someone else - whereas a commit it wrote itself is guaranteed to be from the correct/local account.

[–] alt227 1 day ago

Can it not check the current credentials that it would potentially be using to make said commit?

[–] jstanley 1 day ago

Sure, I was providing an example of how it could be done, not an exhaustive list.

[–] daitangio 2 days ago

I am developing a project to sandbox AI coding agents at very basic level: https://github.com/daitangio/take-ai-control

I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.

It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.

As always feedback is wellcomed

[–] NateEag 16 hours ago

You want a VM, not a container, because VMs are harder to escape.

since my employer is compelling me to throw out my expertise and rot my brain with Claude, I've been using clawk to sandbox instances in VMs: https://github.com/clawkwork/clawk

It's not perfect, but it works pretty well, and has done a nice job of forcing me to think through exactly what I'm allowing Claude access to and why, and what the risks are.

[–] creesch 1 day ago

> I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.

Maybe use two containers in the same docker network. One docker container has the agent and is not allowed to leave the network. The other container you'd run a proxy in with whitelisting and that container is allowed to leave the network.

[–] Melatonic 1 day ago

Why not use a microVM instead of a container ?

[–] wodenokoto 1 day ago

> Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.

This is definitely a question that sounds straightforward but isn't. Like, when I ask antigravity to commit to git, it gets an error because ~/.gitconfig is outside the sandbox.

[–] grey-area 1 day ago

Sure, it's a hard problem, that doesn't mean we shouldn't tackle it. It is in fact one of the more urgent problems for Anthropic to address properly.

I'd feel a lot safer granting fine grained permissions like that, than knowing that the only thing stopping the LLM reading files is that it hasn't thought to do so.

I mean, I think Claude has some controls on file access, but I'm not exactly sure any more what is and what isn't allowed. The impression their desktop app gives is that you need to give permission for each and every file or folder access, but I'd feel a lot safer if that were imposed by an operating system level constraint, not claude trying to read the use of tools and ok/disallow them based on what an llm thinks.

[–] handoflixue 1 day ago

It seems very unlikely that "leaking email addresses" is anywhere near being "one of the more urgent problems for Anthropic". This is a company whose training models occasionally commit felonies, and whose IPO documents claim that they might potentially kill all of humanity.

[–] grey-area 1 day ago

This is not just about email addresses. It’s a bigger problem than that.

[–] rplnt 2 days ago

I usually run claude sandboxed, but had to do something on Windows and didn't want to be bothered. Opened a project, asked something generic about it and in the first response Claue tells me it tried to fetch all URLs it found it in it and what errors were in responses. Cool stuff.

[–] dachris 2 days ago

Yes, they need to be heavily sandboxed. On my machine, LLMs are constrained to docker containers for me, no exceptions.

Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).

[–] YetAnotherNick 2 days ago

No question needs answering. If you want to run claude code inside sandboxed environment, it's not that hard and there are lot of options including official[0].

[0]: https://code.claude.com/docs/en/sandboxing

[–] grey-area 2 days ago

From the doc, this suggestion is hardly satisfactory:

The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.

Also this is in my view the main job of a scaffold like claude code - to restrict what the agent can see and make sure it doesn't use info it should not. It's not something a user can easily or should have to attempt to control themselves.

[–] YetAnotherNick 1 day ago

File tools, by default asks permission to edit outside directory. There is no MCP tools or hooks by default and if you install it you need explicit permission to trust it.

[–] SamInTheShell 1 day ago

These CLI sandboxes are trash, use something else. Container, VM, not your computer. Just don't run it on your bare system, please.

[–] csomar 1 day ago

The models are very aggressive in finding the info they need. I had one find some API key somewhere so that it can make requests. Sloppy on my part of having API keys not related on the hard drive but was not expecting the model to burn my harddrive in a lookup for api keys.