7 ms·

There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access. Imagine if the CLI pulled your SSH keys or other sensitive informat

by ashishb 2mo ago

There is a reason I run all such CLIs inside a sandbox [1] giving limited directory access. Imagine if the CLI pulled your SSH keys or other sensitive information by mistake? Programmers do make such mistakes all the time. I don't want to count on whether "uploading all files it can access" is intentional or a mistake. 1 - https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox

beepbooptheory 2mo ago
But in this particular case isn't the problem that it's sending everything in the sandbox? Rather than what it might do in an otherwise un-sandboxed system?
- ashishb 2mo ago
  > But in this particular case isn't the problem that it's sending everything in the sandbox? If a CLI is touching certain files, they are likely to be leaked one way or the other. Why not reduce the attack surface? When does someone visit your house? Do they get unfettered access to your bedroom & safe as well?
  - beepbooptheory 2mo ago
    Gotta say, if I ever was, I am really not envying the AI guys these days! Sounds terrible!
exitb 2mo ago
What’s described here isn’t connected to the agentic/AI nature of the software at all. Every single program you run as a regular user could potentially do this.
- ashishb 2mo ago
  And I run most of them inside sandbox now. Why would you let a markdown linter access your ssh keys?
  - qup 2mo ago
    Because I'm confident nothing will happen if it does
    - ashishb 2mo ago
      > Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ https://aws.amazon.com/security/security-bulletins/AWS-2025-... 2. Scanners like Trivy have been compromised - https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise https://socket.dev/blog/trivy-under-attack-again-github-acti... 3. Redhat is shipping backdoored FOSS packages - https://access.redhat.com/security/vulnerabilities/RHSB-2026-006 https://access.redhat.com/security/vulnerabilities/RHSB-2026... 4. Even fake and malicious ESLint packages have been published - https://gbhackers.com/eslint-package-attack/ https://gbhackers.com/eslint-package-attack/
- kordlessagain 2mo ago
  Open source project are unlikely to do this, however.
potamic 2mo ago
The readme is confusing. You say it has bubblewrap, but you also have an FAQ saying why not to use bubblewrap? Another FAQ says why not to use sandbox-exec for mac, yet the link for mac goes to sandbox-exec?

by ashishb 2mo ago

beepbooptheory 2mo ago

But in this particular case isn't the problem that it's sending everything in the sandbox? Rather than what it might do in an otherwise un-sandboxed system?

ashishb 2mo ago
> But in this particular case isn't the problem that it's sending everything in the sandbox? If a CLI is touching certain files, they are likely to be leaked one way or the other. Why not reduce the attack surface? When does someone visit your house? Do they get unfettered access to your bedroom & safe as well?
- beepbooptheory 2mo ago
  Gotta say, if I ever was, I am really not envying the AI guys these days! Sounds terrible!

exitb 2mo ago

What’s described here isn’t connected to the agentic/AI nature of the software at all. Every single program you run as a regular user could potentially do this.

ashishb 2mo ago
And I run most of them inside sandbox now. Why would you let a markdown linter access your ssh keys?
- qup 2mo ago
  Because I'm confident nothing will happen if it does
  - ashishb 2mo ago
    > Because I'm confident nothing will happen if it does Well, best of luck. 1. Amazon has shipped backdoored packages - https://aws.amazon.com/security/security-bulletins/AWS-2025-015/ https://aws.amazon.com/security/security-bulletins/AWS-2025-... 2. Scanners like Trivy have been compromised - https://socket.dev/blog/trivy-under-attack-again-github-actions-compromise https://socket.dev/blog/trivy-under-attack-again-github-acti... 3. Redhat is shipping backdoored FOSS packages - https://access.redhat.com/security/vulnerabilities/RHSB-2026-006 https://access.redhat.com/security/vulnerabilities/RHSB-2026... 4. Even fake and malicious ESLint packages have been published - https://gbhackers.com/eslint-package-attack/ https://gbhackers.com/eslint-package-attack/
kordlessagain 2mo ago
Open source project are unlikely to do this, however.

potamic 2mo ago

The readme is confusing. You say it has bubblewrap, but you also have an FAQ saying why not to use bubblewrap? Another FAQ says why not to use sandbox-exec for mac, yet the link for mac goes to sandbox-exec?