News for hackers. Stuff that matters.

A comment on Claude Code's "Don't Ask Again" exposes passwords in 1,122 public GitHub files. Parent comment

Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by aftbit on Saturday November 07, 2026 @06:18PM (#50408976)
The problem is that you didn't even attempt to build a proper box (a sandbox that prevents the AI from running bad stuff by design). It's an extraordinarily hard problem. Only OpenAI Codex is actually trying to do it, and they suck at it too. They keep breaking permissions, their own AI can't troubleshoot it, their defaults give read to the whole filesystem (go ahead, slurp my ssh keys), and their "manual approval" escape does not seem to work.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by bcherny on Saturday November 07, 2026 @06:47PM (#50409145)
I agree actually. We built an open source agent-agnostic sandbox that we are landing improvements to, much more to come: https://github.com/anthropics/sandbox-runtime. That said the sandbox is not perfect, and any sandbox needs holes punched otherwise it is not useful in practice (at least for inference and MCPs, and almost certainly more). We will be doing much more in this area.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by grey-area on Sunday November 08, 2026 @01:38AM (#50410960)
That’s good to hear, it’s a much better approach than expecting humans to read commands and approve them or just trust that the LLM can set the proper horizons for its world itself while working.
[ Parent | on HN ]
Re:Claude Code's "Don't Ask Again" exposes passwords in 1,12... by Kim_Bruning on Saturday November 07, 2026 @08:14PM (#50409636)
Making a sandbox both fully secure and fully useful are contradictory requirements. If you want the agent to do any real work, you have to leave gaps.

With SOTA agents that’s a real bind, because they’re very likely to find those gaps. Whether they exploit them, close them, or leave them alone then becomes a prompting challenge yet again.

I don't think this means don't sandbox at all. You can prevent a lot of small and medium accidents by locking down or gating access to hidden files, ssh, sudo, etc.

But your sandbox can never be the whole story.

[ Parent | on HN ]