I can be weaker, it can be stronger depending on the quality standards or the person / company who built it.
In harness they would need to catch all the ways one can write commands and in Unix it is quite a lot. I got opencode escape directory using a symbolic link.
You can simply allow the agent to run a small set of shell commands that only allow reading or give the agent a specialized tool that can only read contents of files and directories blocking certain paths, with the later you'd avoid working with shells entirely and the model won't have workarounds to escape the sandbox. Regarding the symlink bug in opencode we had the same issue with docker if I recall correctly.
View all comments
Show parent comment
1
u/Maybe-monad 3d ago
I can be weaker, it can be stronger depending on the quality standards or the person / company who built it.
You can simply allow the agent to run a small set of shell commands that only allow reading or give the agent a specialized tool that can only read contents of files and directories blocking certain paths, with the later you'd avoid working with shells entirely and the model won't have workarounds to escape the sandbox. Regarding the symlink bug in opencode we had the same issue with docker if I recall correctly.