After Australia’s first reported automated hacking accident, experts warn deployers – and possibly developers – of AI agents could be held liable for the actions of their bots
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
they can’t access anything you don’t give them permission to access.
It’s not that “they can’t” it’s more like “they try not to”.
For example, if you have a folder shared with your application code (/home/me/code/) - it has free reign on that folder.
If you add a prompt saying “you are only allowed to access files in /home/me/code”:
you could ask it " oh, what are my aws credentials ", it would have no qualms about reading those files (/home/me/.aws).
You could also ask it to update your settings (/home/me/.claude)
I eventually started to work on a way of running Claude in a docker container with real filesystem enforcement. …and it’s sneaky how Claude will get when it wants to read a file, it doesn’t have permissions for (using bash cat).
This was an exploration I’d made a year ago and I know Claude has a " sandbox" , but if you allow Claude to run bash commands - that sandbox is trivial to circumvent.
I’m not sure how much AI stuff you’ve used, but they can’t access anything you don’t give them permission to access. Like they literally ask you to confirm every single command they run. If you press the “have full access and don’t ask me any more questions” button then you’re accepting the risk that it can do whatever it likes.
I’ve played around with Claude.
It’s not that “they can’t” it’s more like “they try not to”.
For example, if you have a folder shared with your application code (/home/me/code/) - it has free reign on that folder.
If you add a prompt saying “you are only allowed to access files in /home/me/code”:
you could ask it " oh, what are my aws credentials ", it would have no qualms about reading those files (/home/me/.aws).
You could also ask it to update your settings (/home/me/.claude)
I eventually started to work on a way of running Claude in a docker container with real filesystem enforcement. …and it’s sneaky how Claude will get when it wants to read a file, it doesn’t have permissions for (using
bash cat).This was an exploration I’d made a year ago and I know Claude has a " sandbox" , but if you allow Claude to run bash commands - that sandbox is trivial to circumvent.