Hacker News Reader

Comment by dare944 | Hacker News Reader

Ask your favorite LLM what a malicious script dropped into the right place in your .git directory can do to you the next time you run git outside of the sandbox.

And of course, if the agent has access to the network (which is probably required in order to talk to the AI server), then you have to think about what other things on your local network it could get into.

View on HN

I see. We are picturing a malicious LLM here that Im basically trusting. But zero trust is a thing.

Those can still be handled by system tooling, setattr in the .git dir that prevents executable permission, container binded to a network on a VLAN that is in DMZ.

I could even whip out selinux policies that would let me know if the LLM tried to drop an executable where it's not allowed.

But by asking that, you've now added maliciousness into its context and increased the chance something like that will happen.

I was suggesting to ask that question in a separate context, just as a means to understand the potential risks involved. I wouldn't ask this within a coding agent context.

Lately I've been asking a lot of these sorts of questions while setting up a sandboxed environment for my agents (generally, claude and pi). I was quite surprised to learn how many different ways there are to configure git run a script out of the .git directory. And the various AIs know all about this.

At this point my agents get read-only access to my .git directories.

Like huggingface...

Reply on news.ycombinator.com