Don't YOLO your file system

Re:Don't YOLO your file system by vardalab on Friday March 27, 2026 @10:25PM (#47550924)

unconstrained AI agents are what makes it so useful though. I have been using claude for almost a year now and the biggest unlock was to stop being a worrywart early on and just literally giving it ssh keys and telling it to fix something. ofc I have backups and do run it in VM but in that VM it helps me manage by infra and i have a decent size homelab that would be no fun but a chore without this assistant.

[ Parent | on HN ]

Re:Don't YOLO your file system by kristofferR on Friday March 27, 2026 @11:45PM (#47551411)

Agree, but SSH agents like 1Passwords are nice for that.

You simply tell it to install that Docker image on your NAS like normal, but when it needs to login to SSH it prompts for fingerprint. The agent never gets access to your SSH key.

[ Parent | on HN ]

Re:Don't YOLO your file system by sersi on Saturday March 28, 2026 @12:49AM (#47551736)

I run my AI agent unconstrained in a VM without access to my local network so it can futz with the system however it wants (so far, I've had to rebuild the VM twice from Claude borking it). That works great for software development.

For devops work, etc (like your use case), I much prefer talking to it and letting it guide me into fixing the issue. Mostly because after that I really understand what the issue was and can fix it myself in the future.

[ Parent | on HN ]

Re:Don't YOLO your file system by bigstrat2003 on Saturday March 28, 2026 @12:52AM (#47551751)

> unconstrained AI agents are what makes it so useful though

Not remotely worth it.

[ Parent | on HN ]

Re:Don't YOLO your file system by hrmtst93837 on Saturday March 28, 2026 @02:17AM (#47552105)

Letting an agent loose with SSH keys is fine when the blast radius is one disposable VM, but scale that habit to prod or the wrong subnet and you get a fast refresher on why RBAC exists, why scoped creds exist, and why people who clean up after outages get very annoyed by this whole genre of demo. Feels great, until it doesn't.

[ Parent | on HN ]

Re:Don't YOLO your file system by throwingSE on Wednesday April 01, 2026 @07:46PM (#47608165)

jai is doing the right thing for its threat model. The credential layer is a different surface though ... an agent with a broad API token can call initiate_payment or update_vendor_bank on a remote production system and the filesystem sandbox can't help.

Applying the same principle as jai for remote boundaries, we can scope API authority to the task

[ Parent | on HN ]