I tricked Claude into leaking your deepest, darkest secrets

Re:I tricked Claude into leaking your deepest, darkest secrets by rmunn on Wednesday July 15, 2026 @04:29AM (#48917841)

I've been running Claude Code in a VM, where I clone the GitHub repos I want it to work on (they're open source so no login info needed) but have no other credentials. I used to reset the VM every day, but that was getting to be a bit of a hassle so I switched to a monthly reset. But even so, it would be hard for Claude to exfil anything more than what open-source projects I've been working on in the past month (at worst). Which still could tell someone quite a lot about me, but most of that info is already out there available with a Google search — after all, when you contribute to open source projects, your name and email address get stored in immutable Git history.

But after seeing this, I think I might switch to a weekly VM reset rather than monthly.

BTW, if anyone is interested in a decent setup for an AI agent jail, the scripts at https://jai.scs.stanford.edu/arch-vm.html are what I used, plus adding a few more packages to the pacstrap command such as dotnet-sdk. I then made the guest root directory a BTRFS subvolume, so that I can snapshot it. Then spinning up a new VM is a `sudo btrfs subvol snap template-root newvm` command (basically instant) followed by running the `qemu-system-x86_64` command (takes a couple of seconds). It's easy, but I retain complete control over the contents of the VM. It's been great so far.

[ Parent | on HN ]

Re:I tricked Claude into leaking your deepest, darkest secrets by Arnt on Wednesday July 15, 2026 @05:40AM (#48918364)

I've done something like that too, but I find it restricting.

I want back-and-forth, very approximately like when I do pair programming. The dividing line between what I do and what the AI does varies according to task and sometimes during the task, and is seldom clear at the start.

Then there's the work that wants a human to click buttons and decide whether something is a good and correct user experience. The AI does not have access to my display if I can avoid it.

Overall, the model you describe is one that's worked very well for me, but for some problems. An unsatisfyingly small set.

[ Parent | on HN ]

Re:I tricked Claude into leaking your deepest, darkest secrets by hyusap on Wednesday July 15, 2026 @05:07AM (#48918148)

note that this wasn't claude code but claude ai the main website

[ Parent | on HN ]