Why is your agent able to call ssh. Why can it trigger 1password. Why are you giving metaphorical guns to metaphorical toddlers. Why is it not sandboxed. Your practices worry me.
replyAre you guys all running agents in VMs?
replyYes.
replyContainer or full blown VM?
replyI use containers in one context (custom container manager) and a regular UNIX account on bare metal in another.
replyThis isn't intended to stop a model like Astra hacking its way out of course, it's more like guardrails on a staircase.
My personal container manager tool has an intercepting SSL proxy and small Javascripts on the host can rewrite or block HTTP requests. The agent gets its own isolated home directory and can't tamper with mine. Local caches like Maven are mapped read/only with a write layer on top.
ChatGPT desktop this morning lost a chat thread while I was actively working in it. I asked Astra to find the lost session, and next thing I know it's prompting for full computer control to drive Finder. It's just jsonl files on disk, not hard to read normally.
replyNegative feedback filed and ChatGPT uninstalled.
You have to watch it like a hawk so it doesn't do something to production, on its own, without a specific request? Wow. Then I could never trust it to not be doing something to some other system that it shouldn't, so I'd have to audit every network request.
replyIf enraged_camel had been doing something else involving the production database at the wrong time, they might have accepted the 1Password prompt.
Worth noting that this has never, ever happened with Anthropic models, which I've been using all day every day since Opus 4.1.
reply