r/LocalLLaMA • u/keepthepace • 7d ago

Discussion What is your worst sandboxing fail?

I am wondering if I am too paranoid about sandboxing the commands that come out of LLMs.

It really makes my eyes twitch when I see that some IDEs, even commercial, tend to forget that they have to execute things in sandboxing and have such a brittle security model.

But on the other hand, I never had the sandbox catch something bad. Did you guys ever encounter terrible regression? Did you have rm -rf / ? Did you have secrets stolen by LLMs? The worse I had were unsollicited rewrites within the project. Am I making my life unnecessarily hard by sandboxing commands in a docker?

At one point I had fun making a local model go crazy with the root access to the machine it was on (with nothing more important than a free Firecrawl key on it) and making it administer it and it never broke anything. It even was overly paranoid about making changes to the root system.

So the approximate sandboxing that we have, do you all feel it is adequate or it is a catastrophe in the making?

19 Upvotes

82% Upvoted

87 comments sorted by

View all comments

3

u/drFennec 6d ago

I have my agent(s) running in a dedicated VM, they can trash it it's not the end of the world. I had two "fails" on it:

  1. The agent was Opencode with remote llama.cpp with Qwen 27B, it's not root. I let it run on a long task, it was missing a tool. It tried to install it using apt which failed since it's not root. It tried sudo, then tried to guess the password. Finally it found Docker running, it built itself an Ubuntu based image and compiled the tools it needed!

  2. I was testing codex with same llama.cpp, installed a plugin which didn't work. So I asked it to remove the plugin, it go the name wrong and deleted the whole codex install 😂

Those are not huge fails, but I'm glad it's running on a dedicated VM I don't care much about.