This is hard to avoid. All it needs to do is make a git commit and look in the git log and it will find out who you are.
- Option 1: Don't give Claude the `.git` directory
- Option 2: Build a `.git` anonymizer that overwrite git history with bogus emails
LLMs are supposed to be a panacea for building digital systems. A sandbox inside which an LLM can operate freely surely should be one of the first systems we should all strive to engineer.
If we can't properly sandbox an LLM, I would say that's a pretty good sign that LLMs are not a panacea for building digital systems.
This is definitely a question that sounds straightforward but isn't. Like, when I ask antigravity to commit to git, it gets an error because ~/.gitconfig is outside the sandbox.
I'd feel a lot safer granting fine grained permissions like that, than knowing that the only thing stopping the LLM reading files is that it hasn't thought to do so.
I mean, I think Claude has some controls on file access, but I'm not exactly sure any more what is and what isn't allowed. The impression their desktop app gives is that you need to give permission for each and every file or folder access, but I'd feel a lot safer if that were imposed by an operating system level constraint, not claude trying to read the use of tools and ok/disallow them based on what an llm thinks.
I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.
It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.
As always feedback is wellcomed
Maybe use two containers in the same docker network. One docker container has the agent and is not allowed to leave the network. The other container you'd run a proxy in with whitelisting and that container is allowed to leave the network.
Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).
The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.
Also this is in my view the main job of a scaffold like claude code - to restrict what the agent can see and make sure it doesn't use info it should not. It's not something a user can easily or should have to attempt to control themselves.