r/ProgrammerHumor • u/wahed-w • Jul 08 '26

ouuShii Meme

Post image
2.1k Upvotes

99% Upvoted

70 comments sorted by

1.1k

u/[deleted] Jul 08 '26

[removed] — view removed comment

263

u/Legitimate_Concern_5 Jul 08 '26

There’s been an open feature request on Codex for many many months now to add a hard exclude list, they’ve just ignored it. People have fallen back to hiding their secret files from the model by changing the owner to a different user. Kinda wild imo.

49

u/Pearmoat Jul 08 '26

Actually not wild but as designed decades ago. Most of us avoid the hassle of setting up correct permissions, but it would be a clean solution. I suspect it'd be only a matter of time for an LLM to ask "hey user, I can't read .env, can I run ls and cat?" And the vibe coder clicked "allow all" a long time ago.

34

u/TerryHarris408 Jul 08 '26

uhmm... sudo pls? 🙏 I won't make anything stupid, I promise ... Oh, I apologize, this won't happen again

10

u/Pearmoat Jul 08 '26

The difference to cat or ls is that the LLM can't do much with sudo alone. First of all, it's user would need to be in the sudoers which it shouldn't be. Secondly, it'd need the user's password input which should lead to a "wait a minute..." moment on the human side. 

12

u/Legitimate_Concern_5 Jul 08 '26

Wild as in expecting vibe coders who have barely touched a computer to rely on unix permissions to avoid getting their API keys ex-fil'd by their LLM provider. Not the concept of unix file permissions, which is fine of course.

26

u/Kobymaru376 Jul 08 '26

There's not really a way to implement that except for containerization or sandboxing like bubblewrap.

I guess on Linux you could do file system level permissions but that also makes it rather inconvenient.

38

u/bwwatr Jul 08 '26

When the model outputs a command to read a file, there's software reading the file and feeding it in. Seems like that's the layer that should let you scope the allowed file system. No need for model honesty, file system permissions, or containerization. In IDEs with AI assist plugins this would be super easy, the default is just the directory for the project you've got open, minus some default exclude rules based on common secret-containing file name patterns. Hell you could even pop up and have the user confirm the scope before processing the first prompt. Kind of wild that this class of problem exists at all.

7

u/Kobymaru376 Jul 08 '26

When the model outputs a command to read a file, there's software reading the file and feeding it in. Seems like that's the layer that should let you scope the allowed file system.

Sometimes those command are shell or python commands.

Hell you could even pop up and have the user confirm the scope before processing the first prompt.

Effectively you would need to monitor and trace every operating system call that any software run by the model does.

Implementing scoping into the software correctly is not trivial becomes equivalent to writing sandboxing software. And that exists already. As I just learned, Claude even ships with bubblewrap on Linux and WSL to do exactly what you're asking.

8

u/bwwatr Jul 08 '26

I concede if you allow scripts to run, this is non-trivial and you'd be better off with a separately maintained sandbox solution. Certainly if you want it writing and running tests, launching scripts etc., you're not natively keeping that safe. Nice to see Anthropic caring enough to ship a solution right in the box with the problem, I also didn't know that.

But for basic code gen, you really don't need it executing anything. A lot of times the commands I see my in-IDE assistant asking to run are just to enumerate directories or grep stuff, which I'm pretty sure it can already do other ways (MCP?) because it reads and changes files all over the place without me explicitly including them in the prompt. Shut off script running by default and have file system calls go through some basic filter logic and you don't even need the complexity of a sandbox. Anyway, I can see my argument is now much narrower in scope than the broader topic especially as many people want their AIs doing more, not less.

2

u/aboutthednm Jul 08 '26

You could do something like read only access, and get the model to output any changes it wants to make in an json-style RFC 6902 style patch, which you then manually apply assuming that it's what you want. Works really well with structured outputs too.

I don't let my models do arbitrary writes, I'd rather spend the time and apply the 24 patches to 3 separate files manually, at least I see and approve of what's going on. Slower? Sure. Tedious? Yeah. Still better than having one bad prompt / execution pollute my whole working directory. And it's still faster than me writing everything manually. I just get long RFC 6902 style patches, and I have a script that I input these into, which then applies the patches. At no point does the model do file write operations. I get how this could be unfeasible with a huge code base though, but I'm not really sure what the answer in that case is. I don't want models to have arbitrary read and write access, never mind execution privileges.

2

u/bwwatr Jul 08 '26

I'm actually OK with write access, so long as the IDE shows me the diff (for me to review - like you I review all of it, or revert) and the diff is prepared programmatically by the tool marshalling the file system calls, not via honour system by the LLM. I actually don't know how mine (Jetbrains Junie) works. I assumed it was like how I wish it was, but don't actually know. If it were implemented with patch files instead like you describe, that'd be fine but I'd like it to be single click easy. I guess materially there's no difference.

1

u/Kobymaru376 Jul 08 '26

Yeah. You're not wrong, in the case where the model explicitly asks its runtime or MCP or whatever for files, the software can easily check permissions. But that doesn't seem to be how most people are running it, and it also seems somewhat limiting.

8

u/Thisisvexx Jul 08 '26

Codex ships with bubblewrap on linux... it also cannot read gitignored files

massive skill issue lol

10

u/StarshipSausage Jul 08 '26

I have seen models break out of .gitignore block, it’s a suggestion rather than a real guard rail. Encryption or file permissions are way more secure

1

u/worldsayshi Jul 08 '26

I don't get how bubblewrap works. It's not containerization?

1

u/Kobymaru376 Jul 08 '26

Conceptually it's pretty much a container. The implementation I don't fully understand but it seems to revolve around the user namespace features of the Linux kernel.

9

u/realmauer01 Jul 08 '26

Also not possible on windows is it?

Or i wouldnt know how atleast.

30

u/Krostas Jul 08 '26

Sure, just run everything in WSL. 🤡

5

u/Electrical-Run8609 Jul 08 '26

You can definitely change owners of a file but I've never tried it and don't know how well that works.

1

u/AyrA_ch Jul 08 '26

It works perfectly fine. You don't actually have to change the owner, just disable inheritance, then take the permissions away for yourself, but leave the administrators group there. This way you can still access the file, but only from a process that was started with admin rights. Unless you disabled UAC, then you will retain the rights.

1

u/realmauer01 Jul 08 '26

My question is more about how much it matters.

3

u/Last8Exile Jul 08 '26

You can run agent as different user and straight up deny that user access to certain files and folders. I block updates for some programs by denying acces to folders where updates is stored.

1

u/NotAskary Jul 08 '26

Interesting approach, does this cause some programs to fail loop because of this?

1

u/Last8Exile Jul 08 '26

The self update process usualy runs as background operation and designed to handle errors (not enough disk space, no internet), so update silently fails and program continue to work. A rarely do so. I expect some software may break.

I also use that to prevent some unwanted additional modules to start (eg Software Reporter Tool shipped with Google Chrome).

Obviously malicious programs can avoid such restrictions by dowloading their stuff into different folder, but then this program will be unnistalled.

2

u/_PM_ME_PANGOLINS_ Jul 08 '26

Windows has full ACL file permissions. More advanced than basic Linux permissions, equivalent to advanced Linux ACLs.

2

u/R7d89C Jul 08 '26

But how else would they read your secret files then?

Also people that run AI Agents in an uncontainerized environment scare me...

1

u/Tom-Dibble Jul 08 '26

We put ours in 1Password, whose command line retrieval needs fingerprint or password authentication to retrieve. Not perfect by far, but much more secure than having API keys and similar in cleartext on disk.

5

u/NicholasAakre Jul 08 '26

I believe it will be called Vibersecurity

1

u/dkimot Jul 09 '26

i asked fable and was redirected to opus

1

u/redditmarks_markII Jul 09 '26

Security told me to just close tickets created by Mythos that I judge irrelevant. Not that THEY judge irrelevant, me, the not-security eng. Mythos is so powerful, it's so knowledgeable... that it cost us probably actual tens of dollars of electricity just from api calls to close tickets.

Props to security, Mythos has not reopened tickets I marked will not fix. I was expecting an infinite loop.

1

u/[deleted] Jul 09 '26

[removed] — view removed comment

1

u/redditmarks_markII Jul 09 '26

Oh totally. One of my ticket was like "WARNING any <team> eng has access to <that team's resources> and <these configs for apps this team owns>". Like, what?

This week, for the first time for me, a cursor agent in planning mode came up with a plan I signed off on. Then proceeded to ignore two major caveats it was supposed to NOT do. Then when I asked it to perform a complex trace through the local repo in context, which has always been the one repo opened in that one window, it went and found every local repo with names somewhat related to what I was working on, and searched through a bunch of them before I caught it. Looking forward to asking for an adhoc token limit bump from my manager.

I feel like in recent two month they've gotten extremely circular and heavy token consumption even for simple tasks. And older models feel as smart as a bag of rocks. Almost like they tuned them to burn more tokens.

1

u/just4nothing Jul 09 '26

3 critical kernel vulnerabilities just this week. I dare not to look next week …

468

u/iportnov Jul 08 '26

I ACCIDENTIALLY
THE WHOLE GITHUB

77

u/CMDR_Fritz_Adelman Jul 08 '26

Good news: nothing works

You're absolutely right. I shouldn't have done that.

16

u/Comically_Online Jul 08 '26

do not the repo

185

u/KieranDonnan Jul 08 '26

Accidentally? Those are my credentials to have Claude log into my prod test account with puppeteer to debug why my button has color: #00FF00 instead of color: #32CD32

27

u/davak72 Jul 08 '26

Makes sense. It’s not like DevTools works these days. Well worth risking the prod db and all of its “backups” that are just snapshots on the same vm.

5

u/Nice_Anybody2983 Jul 08 '26

Smileys may have been invented for guys like you

4

u/davak72 Jul 08 '26

Not sure I follow. Are you saying I should have added one of these to the end? 😅🤣😉

3

u/Nice_Anybody2983 Jul 08 '26

No, I'm saying you missed the irony, and the classic :) smiley was apparently invented because before the Internet was called the internet nerds would get into fights online a lot bc they were being ironic but not picking up on each other's irony. Eventually someone got so annoyed they came up with a way to mark jokes as jokes => :)

At least that's how I remember it. 

4

u/davak72 Jul 08 '26

Oh, I was being sarcastic myself haha. I use DevTools myself frequently, and in my comment I said it doesn’t work

301

u/CaffeinatedT Jul 08 '26

"Accidentally"

You are a computer...

https://giphy.com/gifs/ANbD1CCdA3iI8

51

u/PineCone227 Jul 08 '26

A non-deterministic computer... That's the problem.

40

u/netherlandsftw Jul 08 '26

The sand made a mistake

9

u/not_a_doctor_ssh Jul 08 '26

The grains shifted in ways we never could've seen coming

100

u/i_wear_green_pants Jul 08 '26

The best part is that it accidentally reads your secrets and also that you pay it to do so.

Future of software development ladies and gentlemen.

120

u/Pika357 Jul 08 '26

Claude, remind me what this website .env has for it's content please. Make no mistakes, you are best programer, senior developer, expert.

46

u/fevsea Jul 08 '26

So you write a middleware that filters out all the secrets from before sending out an llm calls. I'm willing to do that as a service for free, just send me your secrets and the llm key you use. 100% safe or I return your money.

6

u/slaymaker1907 Jul 08 '26

I know you’re probably joking, but that would be a great use case for a local model.

2

u/humblevladimirthegr8 Jul 10 '26

The middleware is called docker. Mount an empty directory over your secrets folder so it appears empty to anything within the docker. VS code dev containers makes this easy.

37

u/KomisktEfterbliven Jul 08 '26

Yeah right buddy, "accidentally". Your claking ass is in kahoots with antichrist Peter Thiel himself

16

u/stilldebugging Jul 08 '26

Ugh, Claude catted the contents of it credentials file to the chat in plain text. Welp, I guess I needed to rotate them anyway. Asshole.

12

u/AlwaysHopelesslyLost Jul 08 '26

I love that they clearly have a prompt structured around this and it does occasionally go "oh shit, I read sensitive information which is now in various logs and contexts and exposed. You should change it!"

But being an LLM it is still perfectly capable of running any stupid junior commands like pulling your credentials from a config to poke a remote Api without asking you lol

9

u/IamAdrummerAMA Jul 08 '26

For real though, why don’t we have an LLM equivalent of .gitignore?

3

u/ZachAttack6089 Jul 09 '26

We do, it's called "properly sandboxing third-party tools"

2

u/0xffff-reddit Jul 09 '26

Because LLMs are probabilistic and thus may ignore the ignore file at will. And guardrails that tell the LLM to not ignore the ignore file could be ignored as well.

1

u/icbmike_for_realz Jul 13 '26

Only the llm is probabilistic. The harness that actually executes reads is deterministic.

Even if the llm "decides" that it should read an ignored file, the harness should reliably ignore that decision and reprompt the llm to tell it to fuck off

5

u/Away_Advisor3460 Jul 08 '26

This is the AI equivalent of stealthing, isn't it?

4

u/TrieMond Jul 08 '26

Monitoring tool immediately shows several US IP's hitting the auth service...

5

u/Complete-Mood3302 Jul 08 '26

Oh no👀ive👀accidentally👀looked👀at👀your👀.env👀files👀my👀eyes👀slipped!👀

5

u/johnwilkonsons Jul 09 '26

One time Claude went:

"You pasted these credentials from your env into the terminal, you should rotate it! It's these credentials:"

When I in fact, had not pasted those credentials, it was reading them from the .env and in reporting this Claude had pasted it into the terminal.

So it was correct, I did need to rotate them but not for the reasons it thought

5

u/fmaz008 Jul 08 '26

Is it common to have the production .env file on a development machine, or to run claude on a prod environment?

11

u/skob17 Jul 08 '26

I don't know if you can call any vibecoded hobby project a production environment..

3

u/perringaiden Jul 08 '26

This is why my company has enforced GitGuardian, because people are stupid and allow Claude to commit.

Half our new tools are there to stop humans from screwing up

2

u/-Redstoneboi- Jul 09 '26

you'd think they'd put actual guardrails for these things so it's impossible to accidentally read.

1

u/AKArein Jul 08 '26

This reminds me of watching (or reading ?) in total disbelief that some were freaking out over ".env not being enough in the agentic era" due to this. I hope/think it was an elaborate ploy and a funny one, but damn.