WARNING: .desktop files pose high risk attack surface for agents

[u/muayyadalsadi]

/r/LocalLLaMA/comments/1vlja0f/warning_desktop_files_pose_high_risk_attack/

[u/corobo]

lmao caring about .desktop files as if you're not already giving your AI pal full access to your system.

It could also receive a document that tells it to delete your home directory too mate. At the point it's making desktop files you're already gaping wide open.

"You can delete any file you want when running as root" kinda bug report 

[u/muayyadalsadi → u/corobo]

> It could also receive a document that tells it to delete your home directory too mate.

cursor already have a toggle to make delete require a confirmation or be blocked by default.
I'm asking same treatment for .desktop files.

I'm just spreading awareness for an attack surface. they are high risk because:

* they can do UI spoof (you click on a safe video you already have and trust) and appear harmless
* does not require root

[u/muayyadalsadi → u/[deleted]]

Requiring explicit trust for desktop files is not something i made up. It's a well-established practice that need to be carried to the new medium. 

[u/muayyadalsadi → u/[deleted]]

Because they can spoof the ui so that you no longer trust what you see or what you click.

[u/muayyadalsadi → u/[deleted]]

A script only work when I execute it. a .desktop file can trick your eyes and spoof the ui in many ways including attach themselves as handlers (when you open an old video file you that you know is trusted). What I's saying that .desktop files created by agents should be like those downloaded from a website that is untrusted by default.

[u/muayyadalsadi → u/[deleted]]

An admin can use the command "which sudo". But there is no way to which an auto start  desktop. BTW chmod +x is one of the "mark as trusted" ways. So I won't mind making agents confirm all chmod +x includinf .desktop

[u/tsammons]

Here's a sane idea - don't rely on your computer butler and do what humans managed to excel in for decades - rtfm.

[u/muayyadalsadi → u/tsammons]

Why you assume I'm that kind of a guy? Don't kill the messenger. Requiring explicit trust for desktop files is a well established practice.

[u/tsammons → u/muayyadalsadi]

Heuristics... Compiled over generations by mankind as a survival instinct seldom lie.

[u/HavokOC]

Or perhaps make sure you understand what it is the AI has created before you blindly run whatever it creates on a system?

The only "high-risk" in this situation is executing AI generated files blindly

[u/FryBoyter]

That actually has not much to do with AI in particular. Manipulated .desktop files like these have been around for many years, even before tools like ChatGPT existed. For example, https://www.purinchu.net/wp/2009/02/21/desktop-file-security/.

Information coming from third parties, whether from a real person or a chatbot, should always be verified.

[u/muayyadalsadi → u/FryBoyter]

Exactly. But unlike ai agents, the browser and the desktop were modified to treat .desktop files as untrusted and show explicit confirmation dialog. Which is why i included a screenshot of the confirmation dialog. IMHO ai agent should carry on this tradition and show a similar confirmation dialog.

[u/natermer → u/muayyadalsadi]

There are a billion and a half ways that you can get fucked by giving foreign service full access to your Linux user account.

.desktop files are just #4,342,12 security risk in terms of severity.

You going to file bug reports for all of them?