borenstein

8 ms·

1.
by borenstein 8mo ago
SUPER interesting! You just earned star #508. Going to take a look at this.
2.
by borenstein 8mo ago
1. It's designed to give you an experience identical to using the Claude Code CLI in every respect, but with a much smaller blast radius. It's not currently set up to to work with your IDE. In that sense, it's a niche solutio
3.
by borenstein 8mo ago
Ah, let me clarify: I'm only using this to help me code faster. There are zero agents in the runtime for the financial tool. As a matter of fact, the tool is zero-knowledge by design: state is decrypted in your browser and encrypted ag
4.
by borenstein 8mo ago
No shame in this! When you're using Claude code (or Cursor, or similar), you get these pop-ups rather frequently. "May I do XYZ web search?" "May I run this command?" "May I make this HTTP request?" This i
5.
by borenstein 8mo ago
> How safe do you think this solution would be to let users execute untrusted code inside while being able to pip install and npm install all sorts of libraries It's designed to be fairly safe in exactly that situation, because it&#
6.
by borenstein 8mo ago
On that note, yolo-cage is pretty heavyweight. There are much lighter tools if your main concern is "don't nuke my laptop." yolo-box was trending on HN last week: https://news.ycombinator.com/item?id=46592344
7.
by borenstein 8mo ago
Totally agreed, but that level of attack sophistication is not a routine threat for most projects. Making sense of any information so exfiltrated will generally require some ad-hoc effort. Most projects, especially new ones, simply aren&#x2
8.
by borenstein 8mo ago
Thank you, nice catch. I will patch that today. And cutoff date is almost certainly why it happened. It wasn't "vibe coded" in the sense that I was just describing what I want and letting the agent build it. But it definitely
9.
by borenstein 8mo ago
Docker isn't virtualization; it's not that hard to infiltrate the underlying system if you really want to. But as for VMs--they are enough! They're also a lot of boilerplate to set up, manage, and interact with. yolo-cage is
10.
by borenstein 8mo ago
IMO, you should treat your agent's environment as pre-compromised. In that reading, your goal becomes security-in-depth. Anthropic is trying to earn developer trust; they have a strong incentive to make sure that private keys and other
11.
by borenstein 8mo ago
The credential have been a PITA. I was working on a PR this morning before work; I should have it tonight. You have to be careful because if you look like you're spoofing the client, you can get banned. For Claude specifically, there a
12.
by borenstein 8mo ago
I'm with you here! The idea with yolo-cage is that the worst the LLM can realistically do is open an awful PR and waste your time. (Which, trust me, it will.) Claude suggested the phrase: "Agent proposes, human disposes."
13.
by borenstein 8mo ago
Thank you! Rate limits are an interesting topic with Claude Code right now. The Max subscription has them, and the API does not; but the Max subscription is an all-you-can-eat buffet, and the API is not. yolo-cage was built to be compatible
14.
by borenstein 8mo ago
The leakage issue is real. Before there was a way to use "GPT Pro" models on enterprise accounts, I had a separate work-sponsored Pro-tier account. First thing I did was disable "improve models for everyone." One day I l
15.
by borenstein 8mo ago
This was 100% not AI generated! Honestly, though, I've been talking to AI chatbots so much in the last year that I'm sure their style has rubbed off on me. At some point, I did a little math and determined that I had probably exch
16.
by borenstein 8mo ago
It probably is. Some of this stuff will hang around because power users want control. Some of it will evolve into more sophisticated solutions that get turned into products and become easier to acquihire than the build in house. A lot of it
17.
by borenstein 8mo ago
You are correct both that the AI wrote 100% of the code (and 90% of the raw text). You are also correct that I want a safety guardrail for the process by which I build software that I believe to be safe and reliable. Let's take a look
18.
by borenstein 8mo ago
I know, right? The day I initially thought about posting this, there was another one called `yolo-box`. (That attempt--my very first post--got me instantly shadow-banned due to being on a VPN, which led to an unexpected conversation with @d
19.
by borenstein 8mo ago
Thank you, good question! My original implementation was actually a bunch of manifests on my own microk8s cluster. I was finding that this meant a lot of ad-hoc adjustments with every little tweak. (Ironic, given the whole "pets vs cat
20.
by borenstein 8mo ago
Hi, thanks for your feedback! I can see this from a couple of different perspectives. On the one hand, you're right: those commit messages are proof positive that the security is not perfect. On the other hand, the threat model is that
21.
Show HN: yolo-cage – AI coding agents that can't exfiltrate secrets(github.com)
60 points by borenstein 8mo ago|76 comments
22.
by borenstein 8mo ago
That's an excellent idea! I will give it a shot.
23.
yolo-cage: AI coding agents that can't exfiltrate secrets or merge their own PRs(github.com)
1 points by borenstein 8mo ago|0 comments
24.
by borenstein 8mo ago
It depends what your threat model is and where the container lives. For example, k8s can go a long way towards sandboxing, even though it's not based on VMs. The threat with AI agents exists at a fairly high level of abstraction, and d
25.
by borenstein 8mo ago
This is great - I've been working on a related but different approach called yolo-cage ( https://github.com/borenstein/yolo-cage ) that addresses a different threat model. Yolobox protects your local machine from ac