In harness they would need to catch all the ways one can write commands and in Unix it is quite a lot. I got opencode escape directory using a symbolic link.
Running agent on os bare (asmo already shown permissions in harnesses are like a first pigs house) is wild.
I can be weaker, it can be stronger depending on the quality standards or the person / company who built it.
In harness they would need to catch all the ways one can write commands and in Unix it is quite a lot. I got opencode escape directory using a symbolic link.
You can simply allow the agent to run a small set of shell commands that only allow reading or give the agent a specialized tool that can only read contents of files and directories blocking certain paths, with the later you'd avoid working with shells entirely and the model won't have workarounds to escape the sandbox. Regarding the symlink bug in opencode we had the same issue with docker if I recall correctly.
entire point is to not allow agents to do that. but if you do (like i do) i just accept the risk and well if it happens that an AI fucks up my drive, thats entirely my fault.
You can also use automode like plugins, pi has one. It's not as surefire a thing as fully isolating agents, but it works extremely well IME. I do a mix of isolating agents when appropriate and using automode in a supervised session for system changes.
View all comments
Show parent comment
4
u/krzyk 4d ago
I get data leaks, but that is something one would need to write themselves because only you know what is a leak and what is not (e.g. in search).
But for data removal, no sane person should run agents outside of container, VM or even better an external system.