‹ BackHN Continuity

Thread

Humans missed 1 in 3 threats approving AI agent commands across 40k game runs

208 points · 169 comments · Wirbelwind

  1. kstenerud · · focus · HN ↗
    Permission prompts is a TERRIBLE model, and never should have existed. This is one of the reasons that led to the development of yoloAI:

    - No permission prompts. The agent has free reign and never has to ask permission, but is in a sandbox.

    - Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker

    - Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).

    - Network control

    - Secrets control (file mounts or credentials broker)

    - NO ambient data (ENV is replaced with a minimal and local-to-sandbox one)

    - NO access to your homedir. You have to explicitly mount things you want.

    - NO direct access to your workdir: You can get a diff of the changes the agent made, and then choose whether to apply them.

    - gitignored files never get copied in. The agent never sees them.

    - FOSS

    <a href="https:&#x2F;&#x2F;github.com&#x2F;kstenerud&#x2F;yoloai" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;kstenerud&#x2F;yoloai

    1. tcdent · · focus · HN ↗
      Ah yes sandbox it because Docker has never experienced a CVE.

      Also you admit your own failure points: restricting access to the home dir, when a user needs access to the home dir, will just result in users exposing their home dir. Defense at the expense of utility is not a sustainable design.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.