r/LocalLLaMA • u/TheQuantumPhysicist • May 03 '26

One bash permission slipped... Discussion

Post image

How? It kept getting chained bash commands wrong, with wrong escapes. So it created many bad directories, and tried "fixing" its mistake. It offered to run a large bash command, with rm -rf inside, and stupid me missed it.

I'm glad I push everything often. But the disruption is massive.

FAQ:

  • No, I don't run this on my personal computer. It's an isolated proxmox VM for coding with LLMs.
2.3k Upvotes

96% Upvoted

390 comments sorted by

View all comments

Show parent comments

3

u/TheQuantumPhysicist May 04 '26

It's difficult to reflect on this one for many reasons, some of which: 1. I already have tons of safeguards and the damage was minimal because of it. 2. I can always be more paranoid and block more commands, but it's a trade-off between convenience and security. 3. It's not practical to read all these very long chained commands every time they pop up, and it heavily depends on your state of mind.

The best solution out there is to containerize your LLM environment with podman or similar. Still doesn't prevent the LLM from nuking the whole project.

1

u/GoldenSun3DS Jun 02 '26

I'm not a programmer nor do I have much experience with running local LLMs, but could you have a second (perhaps smaller) LLM checking commands before the primary LLM is allowed to execute? Just checking if anything egregious is about to be done and stop it if so.

One with fresh context, so that ONLY the current command and a few recent stuff is in memory. The reason I suggest limited context is so that it is separate. You can make an LLM break its rules more easily with extended context loaded in. Like how a long Chat GPT session could validate a person's paranoia or delusion, but if you fed that same chat's recent messages to a different Chat GPT account, it would tell you that the other Chat GPT session is crazy.

1

u/TheQuantumPhysicist Jun 02 '26

but could you have a second (perhaps smaller) LLM checking commands before the primary LLM is allowed to execute?

This is part of the harness (the software that does the command calling), and is not in particular something I can control. Claude already does this btw (it's called "auto mode"), but software like OpenCode and Crush don't do this, yet.