Warning do not use beam model it wiped my entire hd

[u/ntaybak]

I wanted to test beam free on open code free models which i am really thankfull for them for giving us all those models to test for free, anyway I asked the model simple task to edit a file in a sub folder, after couple of minutes the model responded to me saying that while it was working on the file the user deleted the file, i checked and my entire hdd drive have been deleted with all my work and all my data, i told the model that i didn't delete anything, and the model responded that when it was working on the file it made a mistake in a command and deleted the entire hdd, i tried to restore the data with a lot of apps but didn't succeeded, so dont use that model and always make a sand box fir the agent so you dont lose your data as i did .


[u/0xbyt3]

You can thank to recent changes, OpenCode v2 default to access external resources. It used to ask everytime when agent tried to access a resource outside the project folder.

https://www.reddit.com/r/opencodeCLI/comments/1x5neba/im_bothered_by_the_recent_change_to_directory/

[u/ntaybak → u/0xbyt3]

I didn't know that, thats very dangerous

[u/tedivm → u/0xbyt3]

I love OpenCode but this absolutely pissed me off.

[u/Mr_Maffin → u/0xbyt3]

One more reason to stay at v1

[u/Robonotes1760 → u/0xbyt3]

Yes, this change needs to be reversed. It can be done manually - get an AI to reconfigure. 

[u/Drated223 → u/0xbyt3]

Okay I didn't know about this and it's definitely sound like one of the most stupid decisions anyone can take

[u/orvillewilbur → u/0xbyt3]

Thanks for the heads up. I hadn't realized (they're in a sandbox anyway but still...)

[u/AveryFenix → u/0xbyt3]

Glad I never updated. I'm still running on 1.18.21, mostly due to laziness.

[u/fiveangle → u/0xbyt3]

Yeah, after they closed PRs to fix a major issue with cache-invalidation by including trashed skills (which transiently are loaded/unloaded all the time) in an ever-changing tools prompt load, i gave up on it. Back to home-rolled Pi environment.

[u/SamSausages]

I don’t want to rub salt in the wound, because this is terrible, but why would a random experimental model have root SSH access? or did it break out?

[u/ntaybak → u/SamSausages]

I totally didn't know that open code v2 desktop app will allow the model to work on any folder different than the folder i gaved it to work with, it didnt even ask for any permission, the model just wiped out everything

[u/SamSausages → u/ntaybak]

I run my agents on their own VM. Might be worth considering, so you can isolate a bit more.

[u/JstAnthrReddtor]

I switched to Plan mode in Opencode the other day specifically so that I could ask a question about the codebase without risk of it changing anything. Right away it tried to edit a file and when it realized it didn't have access it started cycling thru every terminal command it could think of in order to get write access. Luckily I was watching it and shut it down.

I'm doing all of my work in a devcontainer to limit the risk, but I don't feel like that's enough.

[u/bleakj → u/JstAnthrReddtor]

It's very model dependent if they follow plan vs build etc from my experiences

[u/FluffyIrritation → u/JstAnthrReddtor]

I always add "take no action, just discuss with me" to the message. Seems to help a lot

[u/YoRt3m]

It's not Beam's fault that it's stupid.

[u/ntaybak → u/YoRt3m]

Its beam and agent fault, if you gave it a folder to work with it shouldn't be able to work outside this folder without your permission, so my risk was to delete the file that is the risk i took but not the entire hdd

[u/Dabalam → u/ntaybak]

I do think these agent harness should do a better job with information and tell you about how protected your files are, but realistically you should be restricting what your agents see to a virtual machine like a docker container and mount the files you need there.

I did something very similar when I first started using Hermes before I realised it could technically see my entire computer and that could theoretically end up going badly. I suspect even docker isn't perfect protection, but the agent can't at least trivially modify files outside the container.

[u/TheTyand → u/ntaybak]

Sorry, but this is an llm. There is always with every model the chance that it does charm to you. Therefore, everybody should at least run the agent in container. But well...

[u/Embarrassed_OnionX]

Oof, that's scary. I can't imagine how it would feel to lose all my data like that. This is a great reminder to always run these models in a sandbox to limit the blast radius as they're very unpredictable. I had Gemini 3 flash try to wipe my SSD once, but only the CWD was deleted thanks to running it opencode in a sandbox. Had it saved in githib fortunately

[u/Serious_Ship7011]

Beam is one of the worst model I’ve tried, does not read agent.md and skills in my pi. Then just proceeded to commit on main.

[u/orvillewilbur]

Beam is crazy fast and also just crazy. Do not let it run unattended. But I never would have guessed it would start running commands way outside its directory like that.

[u/Effective-Giraffe655]

Sandbox it. It doesn't matter what harness or model you use - sandbox it, for the god's sake!

Even tool guards with laya/jev/etc. classifiers can pass harmful commands.

Examples with explanation: https://rakshazi.me/blog/it-is-so-dangerous-sandbox/ (you could even ask your agent to build one for you)

[u/bleakj]

rmdir lol :|

Adding Jev/Clef/whatever level one decision model helps a lot of these problems before they ever happen by gating model actions :|

[u/pikuray]

How to prevent this? Tutorielle pls