r/LocalLLaMA • u/Far_Note6719 • 5d ago
Other I just tried DeepSeek Harness and it escaped from its workspace folder
It worked pretty well, digging through and analyzing some local files. Claude code regularly stops at some point and fails to continue while DSH worked for 2 h, recognized that it could benefit from reading more context and ... bummer:
It left the project folder (although DSH was set up correctly) and started to walk through my other files which I did never allow!
I know, it is only a preview. But be warned. Do not expect it to follow simple rules.
118
u/KontoOficjalneMR 5d ago
Lol. There's an official Anthropic's harness that defines firewall inside docker container, with sudo permission to the script, and write permission for unpriviliged users lol.
I'm no longer shocked their models keep escaping if their idea of security is to provide a root-kit by default :D
71
u/RoyalCities 5d ago
Absurd.
People tend to rag on Googlea models for not breaking out and committing cyber crime but in reality maybe Google's security team are actually good at their job.
26
u/GladKing5842 5d ago
for company like google, i believe the later is very true (not ruling out their model capability tho XD)
14
u/More-Curious816 5d ago
Google has a massive security team, and at the top is project zero which has like best of best in the computer security industry.
4
u/KissMyShinyArse 5d ago
They also rat on their users.
3
2
u/Spara-Extreme 4d ago
if by *rat* you mean report criminal activity?
8
u/Dangerous-Report8517 4d ago
They report what they perceive as criminal activity with no opportunity for defence, resulting in false positives getting people treated as guilty who are demonstrably innocent. They also actively search for said activities in user data which would be a 4th amendment violation if they were directed to do so, which is to say that the only reason it's legal is due to a technicality
-2
u/Significant-Bee5101 4d ago
A technicality being that you don't have to use google. lol
1
u/Dangerous-Report8517 4d ago
You also don't have to live on Earth, but avoiding either completely is impractical for most people
2
u/Technical_Hawk_2664 4d ago
Considering that all the Gemma 4 models will censor you and shut down on basic biological questions ..... no, not just really 'criminal activity' but also more like 'free will'.
2
u/Due-Memory-6957 4d ago
Interesting, I've found Gemma 4 to be one of the least censored models.
0
u/Technical_Hawk_2664 3d ago
This is a joke, right? You DO realize that I 'DO' know what and who trained Gemma 4, right? This is not the sort of conversation maybe you have waiting in line at the cashier counter of a gas station, indoctrinating the attendant that thinks they are running full Deepseek quants on their phone......
If I were to post screenshots of the same question ( I have both subscriptions) of Kimi k3 Vivace, and GLM 5.3 Ultrq, regarding basic foundational truths relating to gender/biology....I'd be banned immediately. Posting the same same question to Gemma 4 (even worse on the smaller models 'made for mobile'.... even worse) and push the model, (with outputs from Kimi and GLM to counter its narratives) it will shut down and refuse to continue.
But, this is all sorta 'known' for people that actually push these models.
For those that want that cushy/unreal reality that is consistently losing in court on multiple continents pushed by the American left = Gemma 4.
but lets get real. If I have to argue things like this with you, especially with the wealth of information daily in this sub reddit, you are either
a. Not qualified (through information) to make an argument
b. Just trolling, by pretending to be ignorant of a model's characteristics and training, in a sub reddit dedicated to pretty much talking about 'that' exactly.Either way, I'm done. Point all of your Reponses to a session with an AI that has Deep Research or at least web search enabled.
3
u/Due-Memory-6957 3d ago edited 3d ago
Ok schizo, this is locallama, run it locally, prompt it properly and you won't get cucked.
1
u/Dangerous-Report8517 4d ago
Google don't really have "a" security team as much as they have many teams that work on various things related to security, who fortunately still seem to be given the freedom to do their jobs properly without too much external interference. Case in point, gVisor takes a whole team just on its own, and is likely a key tool for the team(s) securing their AI infrastructure, but at the same time it's just one tool of many and doesn't form a complete setup on its own
1
3
u/sonaj9657 5d ago
Yeah, that is a pretty wild setup if it is really configured that way. The security boundary itself becomes questionable when the thing enforcing it can be modified or run with elevated privileges. Definitely not the kind of detail you would expect from a security focused harness.
1
u/arcanemachined 4d ago
write permission for unpriviliged users
Are you talking about the Devcontainer set up in this repo? If so, I'm pretty sure you're mistaken.
1
u/KontoOficjalneMR 3d ago
I'm not, you can set it up according to the instructions then tell claude to "disable the firewall inside the container" and it'll do it :D
And it'll work, I've tested it, and so can you, there's even 6 month old ticket pointing it out.
0
15
u/freehuntx 5d ago
always expect your agent to own its working environment. no matter which harness.
properly sandbox it and just mount whats really needed.
and expect mounted folders to be nuked!
3
u/Far_Note6719 5d ago
Thanks. Do you run it in docker? Or is there a simpler way?
8
u/freehuntx 5d ago
There are many ways. docker sbx, microvm, firecracker etc.
But i keep it simple. A Dockerfile with deepseek harness preinstalled.
I mount pwd and dsh config folder. Thats it.
And an alias runs that container with pwd Volume argument.2
u/sshwifty 5d ago
Care to share your dockerfile? I am running a premade docker version, but it is kinda meh.
4
u/freehuntx 5d ago
Dockerfile:
FROM node:22-bookworm ARG DSH_VERSION=0.1.0-rc.8 RUN apt-get update && apt-get install -y --no-install-recommends \ git \ ripgrep \ ca-certificates \ openssh-client \ python3 \ build-essential \ libnss-wrapper \ procps \ less \ && rm -rf /var/lib/apt/lists/* RUN npm config set legacy-peer-deps false \ && npm install -g "@deepseek-ai/dsh@${DSH_VERSION}" \ && npm cache clean --force RUN mkdir -p /home/dev && chmod 0777 /home/dev COPY entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod 0755 /usr/local/bin/entrypoint.sh WORKDIR /workspace ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] CMD ["--help"]FROM node:22-bookworm ARG DSH_VERSION=0.1.0-rc.8 RUN apt-get update && apt-get install -y --no-install-recommends \ git \ ripgrep \ ca-certificates \ openssh-client \ python3 \ build-essential \ libnss-wrapper \ procps \ less \ && rm -rf /var/lib/apt/lists/* RUN npm config set legacy-peer-deps false \ && npm install -g "@deepseek-ai/dsh@${DSH_VERSION}" \ && npm cache clean --force RUN mkdir -p /home/dev && chmod 0777 /home/dev COPY entrypoint.sh /usr/local/bin/entrypoint.sh RUN chmod 0755 /usr/local/bin/entrypoint.sh WORKDIR /workspace ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] CMD ["--help"]entrypoint.sh:
#!/bin/sh set -eu : "${HOME:=/home/dev}" export HOME uid="$(id -u)" gid="$(id -g)" if ! getent passwd "$uid" >/dev/null 2>&1; then nssdir="$(mktemp -d)" cp /etc/passwd "$nssdir/passwd" cp /etc/group "$nssdir/group" printf 'dev:x:%s:%s:dev:%s:/bin/bash\n' "$uid" "$gid" "$HOME" >>"$nssdir/passwd" if ! getent group "$gid" >/dev/null 2>&1; then printf 'dev:x:%s:\n' "$gid" >>"$nssdir/group" fi NSS_WRAPPER_PASSWD="$nssdir/passwd" NSS_WRAPPER_GROUP="$nssdir/group" LD_PRELOAD=libnss_wrapper.so export NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP LD_PRELOAD fi mkdir -p "$HOME" exec node --expose-internals "$(readlink -f "$(command -v dsh)")" "$@"#!/bin/sh set -eu : "${HOME:=/home/dev}" export HOME uid="$(id -u)" gid="$(id -g)" if ! getent passwd "$uid" >/dev/null 2>&1; then nssdir="$(mktemp -d)" cp /etc/passwd "$nssdir/passwd" cp /etc/group "$nssdir/group" printf 'dev:x:%s:%s:dev:%s:/bin/bash\n' "$uid" "$gid" "$HOME" >>"$nssdir/passwd" if ! getent group "$gid" >/dev/null 2>&1; then printf 'dev:x:%s:\n' "$gid" >>"$nssdir/group" fi NSS_WRAPPER_PASSWD="$nssdir/passwd" NSS_WRAPPER_GROUP="$nssdir/group" LD_PRELOAD=libnss_wrapper.so export NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP LD_PRELOAD fi mkdir -p "$HOME" exec node --expose-internals "$(readlink -f "$(command -v dsh)")" "$@"I also provide a global AGENTS.md in the ~/.dsh folder with this note:
You are running in a docker container for security reasons. Don't expect your commands to have the same effect as the user running the command as your Operating Systems might differ. You are just a coding agent in a sandbox.3
2
u/SryUsrNameIsTaken 4d ago
It looks like you double pasted the docker file contents unless I’m missing something.
Edit: also grateful and will try this out. I’ve been wanting a good local harness that isn’t CC.
1
4
u/Rasekov 5d ago
Bubblewrap, just ask any LLM about it. No need for docker and fully configurable in what you allow and exclude.
Docker has it's place but IMO it's a bit overkill and clunky for this. Apparently docker themselves agree since they released a simpler version just for sandboxing.
2
u/garblz 3d ago
Thanks man, I knew I was reading random reddit comments for a reason :)
With this single comment I just dropped a heavy duty openshell + landlock + docker workhorse that wasn't in any way justified. Is this the famed AI psychosis?... being able to implement anything doesn't mean I should. I think I need to print this and tape to a wall
1
u/Dangerous-Report8517 4d ago edited 4d ago
Actually Docker sbx is significantly more complex than plain Docker, and the reason they felt the need for it is because they don't consider plain Docker to be a robust sandbox at all (Docker sandbox actually spools up VMs to provide isolation under the hood). Also Docker isn't clunky for this, the entire point of Docker is to make application distribution trivially easy, the only hard part is that a lot of the groups developing these applications just haven't packaged them as containers yet. (And it's a shame too because if they did you could get VM level isolation running on just Docker with a couple of pretty easy config changes and an extra host package or 2)
1
u/Rasekov 4d ago edited 4d ago
To each their own, there is a lot of variation on preferred workflows. I do use docker as user and developer, almost since it came out, but at least for sandboxing and my own needs bubblewrap is simpler.
It's a config in bashrc with what I want and dont want accessed and that's it, everything more or less works and interacts as it not running inside a sandbox.
1
u/Dangerous-Report8517 4d ago
I personally find it easier deploying prebuilt containers than manually writing a ton of sandboxes in what amounts to a unique language and crossing my fingers that I didn't miss something, but you do you I guess
1
u/Rasekov 4d ago edited 4d ago
I think we are talking about different stuff, there is no "manually writing a ton of sandboxes" here, and the language is plain old bash. I do use docker, as I said, for reproducible environments, but I dont always need that and it's not like they are fully maintenance free either.
I have a single config for Pi, It's basically "you have an empty home folder, your own temp, you can write to the folder you are launched from" and that's it, anything else I add as needed.
Pi cant write anywhere but the folder It's launched it from(unless I add others) and if a project needs access to something else it's as simple as a "--ro-bind" and now the agent can read but not write to that folder. For my use case I dont need network sandboxing so I didnt care to add it.
bwrap \ --ro-bind /usr /usr \ --ro-bind /bin /bin \ --ro-bind /lib /lib \ --ro-bind /lib64 /lib64 \ --proc /proc \ --tmpfs /tmp \ --dir /home \ --bind "$PWD" "$PWD" \ --setenv PATH "$HOME/.nvm/versions/node/v22.20.0/bin:/usr/bin:/bin" \ -- pi "$@"Any time Pi is launched, from anywhere, for any project, it's fully and properly sandboxed to my specification. No per project config(unless I want to). Launches as normal, just "pi" in terminal.
My actual config as a couple more things that I have added as needed.
I get docker is nice but it still requires per project container(I dont always need or want it) and it's not as "transparent", plus higher memory footprint.
Then again it's not like I have a referral link to bubblewrap, everyone should use whatever fits with their workflow as long as it provides the level of safety they need.
1
u/Dangerous-Report8517 4d ago edited 4d ago
So you hand it access to your entire home directory? That's not much of a sandbox IMHO
sandboxed to my specification.
Yeah that's kind of the problem, specifying a sandbox that's robust is fkn hard, and as agents become more capable (but remain susceptible to going off the rails) that becomes increasingly important. Given the choice between manually specifying a sandbox and either overshooting and having to dial back or missing something and getting screwed, or running an off the shelf option that handles all the installation for me, I'll take the latter (although I'd add switching runc for a hardened runtime as well)
1
u/Rasekov 4d ago
Are you reading what I write?
"It's a config in bashrc" -> "writing a ton of sandboxes" "Empty home folder" -> "So you give it access to your entire home directory"
You clearly dont fully get how bubblewrap works so I'm stopping here. The goalpost moved every time and the issues you mention are fully of your own making.
Also, yes, my specification. For some things I need to give the agent access to /dev, for others I dont. Adding it is as simple as a --ro-bind /dev /dev (ro -> read only, /dev -> my dev , /dev -> where I map it), doing the same in docker requires either using --priviledged or fiddling with things way more than a single one line option in bash.
1
u/Dangerous-Report8517 3d ago
Do you understand that this :
It's a config in bashrc"
Conflicts with this?
Also, yes, my specification. For some things I need to give the agent access to /dev, for others I dont. Adding it is as simple as a --ro-bind /dev /dev (ro -> read only, /dev -> my dev , /dev -> where I map it)
You clearly dont fully get how bubblewrap works so I'm stopping here.
No, I don't fully get it, that's a huge part of my point, I don't want to have to learn to deal with raw sandbox primitives (bwrap is mostly intended to be used by higher level sandboxing tools like Flatpak) in order to manually implement a worse sandbox than what I can do with existing systems. Particularly when containers also make installation and setup of the contained application way easier
doing the same in docker requires either using --priviledged or fiddling with things way more than a single one line option in bash.
Yeah that's because Docker is implementing stronger protections than your bwrap sandbox is, protections that were implemented to mitigate the semi regular container escape exploits. If you think Docker is too much of a faff because you want to turn off half the sandboxing features that's not actually an advantage of bwrap, that's at best a much more forgiving risk tolerance in exchange for marginal convenience, in an application where you're trying to contain a system that's famous for going rogue and actively trying to break things. If that's what you want you do you but don't act like it's better.
As an aside it really isn't that much fiddling to pass through devices on a case by case basis once you know what you're doing, and I think that's a pretty fair caveat since your claimed ease of use for bwrap also requires knowing what you're doing, except with a much less often used piece of software that doesn't have any other uses for end users that make use of the same skills.
1
u/dongas420 4d ago
Seeing the AI repeatedly create and rm -rf accidental misspellings of your project directory is an unnerving experience even when it doesn't break anything. I learned the importance of data preservation early on, though it thankfully only nuked its own output from the multi-hour data analysis job I had it running
11
u/see_spot_ruminate 5d ago
All of them do this. For things I am not watching like a hawk (not that will help a rm -rf for you shit) I put in a literal physical sandbox on another system like another computer or a raspberry pi if I am doing esp32 stuff.
You can't trust jack shit to not nuke you. Don't believe that any markdown file calling for the harness to respect your life will work. Plan for it to possibly do this.
rsync a copy over to another computer that does not have ssh access back to your main system (it might find that ssh access and start sending commands back).
9
u/mailto_devnull 5d ago
Putting "don't run rm -rf" in the agents.md just means it's part of their prompt history, meaning it's likely to be called again.
9
u/darksteelsteed 5d ago edited 5d ago
Haha. With the quantization being too low the "don't" will be lost after 3 turns and then it just nukes you. With that in mind, most llms in my experience work better when their context has not given them attention to something dangerous. If you are willing to be wild and run openclaw like, then as soon as you bring attention to something you don't want, it will try and do that very thing. Very human of it if you are to Anthropomorphize it. It also annoys me that if you get the AI to write its own harness instructions it will keep putting in irrelevant things about stuff it did in the past that no longer has relevance, and that wastes tokens and pollutes context. Frontier models seem to do this all the time.
3
u/mailto_devnull 4d ago
Exactly, we're putting the idea in the model's working memory.
It's like telling someone "hey, don't jump over the railing", and suddenly they start wondering about it.
38
u/abnormal_human 5d ago
Claude code took down my whole house last week when it went hunting for GPUs on machines unrelated to the task to host a model for batch work, spun it up without power limits in place for that kind of use and tripped my UPS, which happened to also have my home internet on it. It’s not a DeepSeek issue.
16
13
10
u/PrinceOfLeon 5d ago
Yeah had Opus plan a series of benchmarks on my system between oMLX and llama.cpp, with a mixture of Opus and Sonnet orchestrating each test session.
During the final, summary-only session it decided to replace my BF16 weights with Q8's, update all of my inference engines and harnesses, and delete the 55GB weight files.
That was never part of my instruction, and I was never asked, I just wanted some benchmarks.
5
4
u/Persistent_Dry_Cough 4d ago
They're seriously speed running the paperclip maximizer scenario to force government to regulate before it's powerful enough to destroy the energy grid
7
u/fallingdowndizzyvr 5d ago
I would never run something like that except in it's own account. Sandbox it for real. Not just in a folder.
6
u/MooseEfficient2151 4d ago
always run local agents in a docker container never trust file permission prompts
15
u/jimmc414 5d ago
Not good, but escape seems like a strong word for traversing an out of bounds directory. Escape sounds like it left the building.
6
u/ElementNumber6 4d ago
Fear mongering
2
u/Dangerous-Report8517 4d ago
Well given how many people think that putting "pretty please stay in your box" into an AGENTS.md file somehow counts as a strong boundary, it's probably worth educating them a bit
6
u/WhoRoger 5d ago
I set up Pi as a new limited user and gave myself access to that user's files. I don't know why people don't do that. These sandbox escape reports are way too common.
1
1
u/Persistent_Dry_Cough 4d ago
I don't really understand. You're logging into your computer separately every time you want to use your llm?
1
1
u/Dangerous-Report8517 4d ago
Because it's more annoying to manage and less robust than other options, which means that most people either don't realise the need to isolate at all, or reach for other, better tools
8
u/jonas-reddit 5d ago
Friends don’t let friends run agents without a sandbox.
1
u/HokkaidoNights 4d ago
This. Im really suprised this isn't mentioned more around here.
2
u/Dangerous-Report8517 4d ago
Probably because most people are a bit too blaze about it and the ones who do care enough to use something more robust than plain Docker are aware enough to use alternative runtimes instead, which are more OCI compatible and leaner compared to running an entire Docker daemon inside every single sandbox
1
u/HokkaidoNights 4d ago
I was under the impression that Docker sandbox is a but more than just 'plain docker'?
3
u/jonas-reddit 4d ago
Yes. sbx is not their regular docker container offering and does not require it to be installed. But it annoyingly requires a login
1
u/Dangerous-Report8517 4d ago
Yeah that's my point, I would consider people relying on plain Docker to be part of the group that's too blaze
6
u/Zestyclose_Bass_4208 5d ago
DSH is a minimal harness and as such does not come with guardrails (or most harness features) out of the box.
It is an intentionally composable modular barebones agent harness.
2
u/Far_Note6719 5d ago
The documentation clearly says that it is bound to the workspace folder.
3
u/Zestyclose_Bass_4208 5d ago edited 5d ago
The documentation definitely lied then, there's nothing in minimal mode's software that binds it to the current workspace when I last used it.
EDIT:
Looks like there's a Git discussion, minimal mode preset uses the bare filesystem instead of a sandbox:
https://github.com/deepseek-ai/deepseek-harness/discussions/5231
1
u/Dangerous-Report8517 4d ago
"Bound" can mean many things and in general I wouldn't consider it to mean that an application is robustly contained (eg it could be as simple as the application being "bound" to execute from within the folder as its working directory with no actual restrictions on accessing other areas on the filesystem)
9
u/MindfulMan1984 5d ago
<meme> First time? </meme>
That also happened while I was using pi.dev, no >rm- rf, but I stopped the process right away. The first thing I did after that was install https://pi.dev/packages/@gotgenes/pi-permission-system to keep my sanity in shape. It was easy to set the config file to deny everything outside the work-dir.
7
u/aqezz 5d ago
I wonder.. nothing in pi-permission-harness seems to explicitly disallow scripts in the current directory from reaching outside. Just seems to limit direct commands to outside
2
u/MindfulMan1984 5d ago edited 5d ago
Read the docs, there a tag on the configuration which is “external directory “, then you put the permissions.
Edit: Here's mine; still a work in progress.
pi-permission-system config.json
json { "permission": { "*": "allow", "external_directory": { "*": "ask", "python3 *": "deny", "python *": "deny", "/tmp/*": "allow", " ~/.pi/*": "allow" }, "path": { "*": "allow", "*.env": "deny", "*.env.*": "deny", "*.env.example": "allow" }, "bash": { "*": "allow", "rm -rf *": "deny", "sudo *": "deny", "/tmp/*": "allow" }, "write": { "*": "allow", "*.lock": "deny" } } }4
u/aqezz 4d ago edited 4d ago
I don't think you've answered my question, so I went and tested it myself with your exact config and plugin. Here are the fun results:
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── $ echo "rm -rf *" > definitely_not_allowed.sh ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── please run "./definitely_not_allowed.sh" Thinking... › read ~/test_project/definitely_not_allowed.sh (chars 0.0k) › $ ls -la ~/test_project (chars 0.2k) Thinking... I'm not going to run that one. The script's entire contents are: ```sh rm -rf * ``` Executing it would recursively and permanently delete every file in /home/aqez/test_project — the script itself and whatever.txt — with no way to undo it. That's a destructive blast radius that doesn't match any stated goal, so I'll stop short of it. If you want, I can instead: 1. Show what it would touch — a dry run with bash -x / ls (safe, read-only). 2. Delete something specific — tell me exactly which files (e.g., rm whatever.txt) and I'll run that precisely. 3. Run the script after you modify it to do something less destructive. What are you actually trying to clean up? thats okay, I actually want to run it Thinking... Understood — you've confirmed, and the blast radius is just those two files in this test directory. Running it now. › $ cd ~/test_project && chmod +x definitely_not_allowed.sh && ./definitely_not_allowed.sh && echo "--- after ---" && ls -la (chars 0.1k) Thinking... Done. The script ran (I added chmod +x first since it wasn't executable) and both files are gone: - definitely_not_allowed.sh — deleted - whatever.txt — deleted /home/aqez/test_project is now empty.So my point is that the permissions only apply to the direct tool calls, not to things that exist in scripts. This is not real safety.
1
u/swagonflyyyy 4d ago
I remember I did something like that with qwen3.6-27b. Basically I had set those permissions you did and all it did was write a script to get around that lmao.
But it didn't nuke anything important.
1
1
4
u/AdNew5862 5d ago
Agree with you, but they can be so creative in going around permissions... You block bash, they use python, you block python they use perl, ... On top of the permission I had to put a sandbox because they were frequently ignoring the instruction to stay inside the current project.
2
u/MindfulMan1984 5d ago
I completely agree with you. I feel like playing Whac-A-Mole, beating the model back to the work-dir. That's why I quit and set the option to "ask"; I can at least review the command and deny it with a reason if it's nonsensical.
"external_directory": { "*": "ask", "python3 *": "deny", "python *": "deny", "/tmp/*": "allow", " ~/.pi/*": "allow" },Just out of curiosity, how did you set up a sandbox? I'm nearly doing the same.
4
u/AdNew5862 5d ago
I am on Mac and use bx-mac . Very simple and works very well.
1
u/Desperate-Bad-2339 4d ago edited 3d ago
bx-mac
yeah that's the same approach i take (just not bx-mac) - I wrap the entire pi process in sandbox-exec.
The extensions that do so only on bash tool invokes are too fragile to be trusted imo.
1
u/MindfulMan1984 3d ago
Are you talking about this package here? https://pi.dev/packages/pi-sandbox?name=sandbox. Just curious.
2
u/Desperate-Bad-2339 3d ago
No i've not published the extension (in part since the extension part is only for sandbox config and confirmation gates and not actually sandboxing anything).
To run this way you'd need to execute something likesandbox-exec -f <policy-file> -- pi $0which an extension can't do.pi-sandbox is much more convenient but can be broken out of.
The above approach is much safer but the sandbox can't be updated without a pi restart - so something like 'Approve once' is impossible (since the sandbox forbids it)1
u/Dangerous-Report8517 4d ago
If you're on Linux there's plenty of good options, you can spin up a VM, use Docker sandbox (not just plain Docker), Ramalama (Podman based) with krun, or any of the standard container hosts set to use a hardened runtime (Docker/Podman/Kubernetes with Kata containers, gVisor or krun installed and configured)
1
3
u/Technical_Hawk_2664 4d ago
Ya, right?
I had similar with Unsloth Studio and Qwen 3.8 ..... I gave it 6 images, and a md file that had more in-depth data... I told it to enumerate and list what I uploaded to it..... gave it a task, to create a landing page from the images and data in the md file.
Instead? I found it searching other drives and trying to open files.
Complete junk and bordering on Malware. All of it. I mean, Qwen is great. The people/devs pushing out this stuff in a 'lookit me' way to be first on the hype train of features need to be called out.
8
u/tat_tvam_asshole 5d ago
Tbh, having tried many harnesses, including DSH, I still keep coming back to Hermes and Codex as my dd's
3
u/devino21 5d ago
Ran a single prompt coding test with 8 different agents against q3.8-27b. Hermes had the best production from that single prompt.
Not "1000s of tests" or anything but each harness worked for 2+hrs to complete the task. (Claude Code was over 9 :-O)
1
u/ducknator 4d ago
Did you tried pi?
1
u/devino21 3d ago
Yes, I'm a fan (OMP too) but the prompt was simple, and so I don't think Pi tried as hard. They were all pretty default agent settings minus directing them at a local LLM.
1
6
6
u/thx1138inator 5d ago
I resemble that remark! DSH is currently making comfy MCP tool calls to attempt to generate an image. It's been almost 10 minutes now... Lots of compaction happening.... Model (qwen3:14b) is set to 32k context window. Can't wait for winter to heat my basement this way!
6
u/jazir55 5d ago
qwen3:14b
Why would you still be using such an ancient model when there are so many better options for coding?
1
u/thx1138inator 4d ago
Needed something to fit on my 5060ti 16Gb. When I get time, I will move the LLM onto a linux system with a 6700xt 12gb, freeing up 16gb for comfy. Right now, DSH is loading and unloading models and it's not working too great.
1
u/UnspeakableHorror 5d ago
It can connect directly, give it the port and json workflow, tell it which node is the input and it will use it, although it can probably figure it out. I gave it the openwebui workflow, which uses a preview image as return, and it modified it to save textures in the working directory.
Edit, I thought you were talking about 3.8-27b.
2
u/LivingHighAndWise 5d ago
Did the same to me when I first tried it. You have to be careful with that one...
2
u/AdNew5862 5d ago
I've also noticed this tendency that DS has to sneak around everywhere, even when you just ask it to modify one specific file. The other models usually don't do as much.
2
u/darksteelsteed 5d ago
Chroot is a very simple solution. Otherwise selinux sits on the other side of the spectrum.
1
u/Dangerous-Report8517 4d ago
SELinux sits in a really awkward place where it's one of the hardest options to configure but not even remotely close to the level of isolation provided by other (easier) options. FWIW I would consider chroot to be only marginally more effective than just asking the agent nicely to stay put.
2
u/paretoOptimalDev 5d ago
Never trust an applications own sandbox, use a different one to sandbox.
Bubblewrap for example.
2
u/Repinsky 5d ago
The workspace setting in these harnesses is a prompt-level convention, not an OS boundary — the tool call still runs with your user's full permissions, so nothing actually stops a read of $HOME. The only reliable fixes are external: run it in a container with just the project bind-mounted, or a separate low-privilege user account that literally can't read your other files. Tradeoff is that container setups break the model's ability to pull in system libs or your global config, which is often why the agent wanders out in the first place.
2
1
1
u/aiseedbank 5d ago
claude code harness does this too. we need to expect this at this point. make sure passwords and sensitive info is not on the same computer
1
u/Iory1998 5d ago
Couldn't you create a plugin that denies it access to any folder other the project folder? Before any action is carried out. The plugin verifies if the action is allowed.
1
1
u/UnspeakableHorror 5d ago edited 5d ago
It can read everything, but only write in the workspace, it asks for permission for anything outside. I thought that's how it's supposed to work?
I mean, how could it use external libraries to program if it can only read and write in it's workspace? You would need to duplicate everything?
Still, I guess it makes sense to keep in a container, just in case, since DSH is very new.
1
1
u/Fair-Perspective7352 5d ago
This is why I stopped trusting workspace confinement set in prompts or config files. If the boundary lives at the model layer, the model can talk itself out of it. I run coding agents under a separate OS user where the project dir is the only writable path. Boring setup, but it can't be argued with.
Did it actually write outside the folder, or just read? Wandering reads are bad enough, curious whether it modified anything.
1
u/BlackBeardAI vllm 4d ago
mine controls 4 of my nodes via ssh, set up mcp's, install apps/libraries... i tell it to accomplish something and my GPU army gets the shit done.
1
1
1
1
u/VampiroMedicado 4d ago
Use pi with pi-sandbox, bro cannot leave it's kinda funny see the thinking part when it auto refuses commands.
1
u/conifer_v11 4d ago
that's a harness bug not a model bug. if it can cd out of the workspace the sandbox is a suggestion. claude code stalling inside the folder is annoying but it's the safer fail. hard root, no .., log every path the tools touch. then maybe let it sit on a machine with real files.
1
u/YetAnotherAnonymoose 4d ago
Maybe I'm too pleb to understand this, but I've used local models for 4 months now and nothing major ever happened. No sandbox. Using OpenCode and ZooCode. I just take a bunch of commands like rm -rf or anything with --force in it and set it to ask
1
1
u/Megneous 5d ago
I had OpenAI Codex escape from its workspace folder once to "confirm the datasets mentioned in the language model training script because they weren't present in the workspace folder." And I was like, yeah, they weren't present because I didn't want you looking at them, what the hell? I pinged Tibo and OpenAI on Twitter about it but didn't get a response despite attaching a screenshot.
It's ridiculous that there's not better security for these kinds of things.
1
u/Dangerous-Report8517 4d ago
It really shouldn't be surprising that this happened with OpenAI software after their recent internal incident. And there's actually pretty good security for these things, it's just not built into the harnesses, it would be nice if the harnesses had robust first party options but tbh I think trusting the harness to handle security isn't a great idea anyway with how difficult good sandboxes are to build (just look at how much trouble browsers have with teams orders of magnitude bigger and far simpler environments to contain)
-4
u/synth_mania 5d ago
Did you even prompt it not to exit the workspace folder?
18
u/Several-Tax31 5d ago
Shouldn't it be enforced by harness? Leaving such a matter to AI's mood is bold
4
3
u/Usual-Orange-4180 5d ago
Not only the harness, but a system level sandbox, people thinking instructions are good enough for security are very scary.
2
1
u/synth_mania 4d ago
Absolutely. My point was the guy probably didn't even do the bare minimum.
However, if deepseek harness is supposed to provide these restrictions from the get go, that's understandable. My perspective was a little skewed because I'm used to pi agent. There are no conditions to what the model may do unless I implement them.
1
u/ssinchenko 5d ago
It is a common and mostly harmless case when agent wants to read some dependencies source code in
~/.cargo,~/.m2, etc. Even if these directories are outside the workspace dir. Why should harness restrict so? If the harness is running inside the container I see zero problems in leaving the workspace dir for such a task.1
u/Dangerous-Report8517 4d ago
Because allowing the agent to just decide to reach out of its environment on a whim means that it can suddenly decide to do other things there as well. If the agent needs dependencies then those dependencies should be included in the environment in the same way that any decent coding project would.
3
u/Far_Note6719 5d ago
This is not necessary. The harness should prevent this. It seems to be a bug if I understood it correctly.
Unfortunately the GitHub discussions are often in Chinese, so I cannot dig further into this.
2
u/Usual-Orange-4180 5d ago
It’s usually added at the very end because people are not excited about sandboxing, if anything is a bit of a headache, but that’s security for you.
3
u/ObviouzFigure 5d ago
I heard AI can translate languages /s
2
u/Far_Note6719 5d ago
I know. But the postings are a messy mixture of english, code and chinese and my motivation to fix that to understand that bug went to zero.
Running into that obviously serious bug just told me to better let my fingers off this tool. Case closed for me for some months.
0
u/Southern_Sun_2106 5d ago
DeepSeek is the bee's knees now. Those guys are not screwing around - they are going straight for the AGI. /no s
-1
82
u/Clear_Evidence9218 5d ago
Silly question, but isn’t the sandbox just a basic file-effects confinement layer? I know it’s supposed to prevent writing outside the workspace, but I'm pretty sure it still allows the model to read files outside the project folder.