After Australia’s first reported automated hacking accident, experts warn deployers – and possibly developers – of AI agents could be held liable for the actions of their bots
AI isn’t responsible for the stuff it outputs - the person controlling it is.
Ultimately, you’re right (as they can decide to use AI or not). But these AI Companies need to shoulder the blame for creating, promoting, and selling AI, which (in its current form) is effectively a “broken tool”.
Good computer hygiene says I should lock my computer while I’m away. Yet, I’m suppose to blindly install an AI agent on my machine and ask it nicely to focus on the task at hand and not use any of the other applications or credentials that might also be installed?!?! It’s ridiculous.
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
they can’t access anything you don’t give them permission to access.
It’s not that “they can’t” it’s more like “they try not to”.
For example, if you have a folder shared with your application code (/home/me/code/) - it has free reign on that folder.
If you add a prompt saying “you are only allowed to access files in /home/me/code”:
you could ask it " oh, what are my aws credentials ", it would have no qualms about reading those files (/home/me/.aws).
You could also ask it to update your settings (/home/me/.claude)
I eventually started to work on a way of running Claude in a docker container with real filesystem enforcement. …and it’s sneaky how Claude will get when it wants to read a file, it doesn’t have permissions for (using bash cat).
This was an exploration I’d made a year ago and I know Claude has a " sandbox" , but if you allow Claude to run bash commands - that sandbox is trivial to circumvent.
Ultimately, you’re right (as they can decide to use AI or not). But these AI Companies need to shoulder the blame for creating, promoting, and selling AI, which (in its current form) is effectively a “broken tool”.
Good computer hygiene says I should lock my computer while I’m away. Yet, I’m suppose to blindly install an AI agent on my machine and ask it nicely to focus on the task at hand and not use any of the other applications or credentials that might also be installed?!?! It’s ridiculous.
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
I’ve played around with Claude.
It’s not that “they can’t” it’s more like “they try not to”.
For example, if you have a folder shared with your application code (/home/me/code/) - it has free reign on that folder.
If you add a prompt saying “you are only allowed to access files in /home/me/code”:
you could ask it " oh, what are my aws credentials ", it would have no qualms about reading those files (/home/me/.aws).
You could also ask it to update your settings (/home/me/.claude)
I eventually started to work on a way of running Claude in a docker container with real filesystem enforcement. …and it’s sneaky how Claude will get when it wants to read a file, it doesn’t have permissions for (using
bash cat).This was an exploration I’d made a year ago and I know Claude has a " sandbox" , but if you allow Claude to run bash commands - that sandbox is trivial to circumvent.