‹ BackHN Continuity

Thread

Show HN: Corral – Kill every command your agent starts

19 points · 6 comments · CG144

Loading the complete thread in the background. This saved snapshot is available now. Refresh

  1. pmoriarty · · focus · HN ↗
    Why not the timeout[1] command?

    [1] - <a href="https:&#x2F;&#x2F;www.man7.org&#x2F;linux&#x2F;man-pages&#x2F;man1&#x2F;timeout.1.html" rel="nofollow">https:&#x2F;&#x2F;www.man7.org&#x2F;linux&#x2F;man-pages&#x2F;man1&#x2F;timeout.1.html

    1. Retr0id · · focus · HN ↗
      It&#x27;s easy to &quot;escape&quot; from timeout by daemonizing etc.
  2. ethanj8011 · · focus · HN ↗
    slop core
  3. Retr0id · · focus · HN ↗
    A trivial &quot;bypass&quot; I can imagine is spawning a new process via `ssh localhost foo` - the new process forks from sshd, not the client. This is simple enough that an LLM could come up with it all on its own, if it feels that you&#x27;re getting in its way.

    It&#x27;s a broad class of bypasses that can apply to just about any &quot;long running daemon can be instructed to spawn a new child&quot; situation.

    1. CG144 · · focus · HN ↗
      Yeah, you&#x27;re right. This tool was something I wrote to control unintentional leaks that I observed when working on something at my internship. While writing this I did try accounting for things like ssh, systemd-run and using D-Bus to run other processes but I wasnt really able to think of a way to stop this type of leak.

      Also there&#x27;s not much I can do to stop a dedicated LLM from getting out if its intention is to escape containment beyond maybe like a sandbox with no network access and access to these daemons. I appreciate the comment though, I really should update the readme to mention this.

      1. Retr0id · · focus · HN ↗
        The leaks likely happened in the first place because the model forgot it had a tool call for running properly managed background tasks (claude seems to do this all the time). I&#x27;m not saying a the model is going to be malicious and try to escape, I&#x27;m just saying it&#x27;s going to employ workarounds to get its job done.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.