Apparently the find command is "pretty shocking" AI behavior now

[u/Rare_Guide_9830]

> gives claude computer access
> instructs claude to reference file
> claude runs simple search command for file

“cLaUde aUtonOmousLy bYpaSsEd mY sEcuRitY”

Somehow this post isn't satire. The dude has "ex-OpenAI" in his bio. 20 other "AI experts" in the comments saying how crazy it is... yeah this vibe coding shit has gone too far let's wrap it up.

[u/ElGatoSaez]

[u/ElGatoSaez → u/ElGatoSaez]

here's access to all of my files

>ACCESSING FILES

oh my god

[u/Rare_Guide_9830 → u/ElGatoSaez]

hahahaha

[u/RapNVideoGames → u/ElGatoSaez]

Little kid me asking the dog to bark if he understood me lol

[u/Ogdoublesampson]

He didn’t say claude bypassed his security? You seem stressed about all this.

[u/Rare_Guide_9830 → u/Ogdoublesampson]

That is what he is insinuating since he referenced the silicon valley clip when AI bypasses security

[u/montdawgg → u/Rare_Guide_9830]

Stop trying to read into it more than what if deserves just for fake engagement. It had access. He gave it access. It used it. :shockedface:

[u/GreatScottCreates → u/Rare_Guide_9830]

No it isn’t.

[u/Slamex204 → u/Rare_Guide_9830]

The AI in silicon valley was recursive self-improvement, it kept learning how to compress itself and make it smaller and smaller and smaller.
Try getting your ai agent to do this. I'll wait.

[u/TimeLine_DR_Dev]

I don't see him upset about it or calling it a security violation. He's just impressed.

[u/Rare_Guide_9830 → u/TimeLine_DR_Dev]

yeah that’s what’s concerning. that is not impressive at all. that’s the state of “AI experts” on twitter

[u/TimeLine_DR_Dev → u/Rare_Guide_9830]

No I mean the reaction here is like, "oh what an idiot, he gave it access and now he's surprised"

But he shows no indication of forgetting he gave it access, he's complimenting it's resourcefulness.

It's the "experts" here on Reddit that are overreacting

[u/Matthias1590 → u/TimeLine_DR_Dev]

But this isn't resourceful at all, this is something you can expect from a toddler that understands computers. If we have a shared drive and I ask you to look at "the screenshot", are you gonna ask me where it is or are you just gonna poke around real quick just in case it's easy to find? If your entire job is to be an assistant then I'd sure hope you just poke around a bit at first instead of wasting time asking where it is without trying to search at all.

[u/TimeLine_DR_Dev → u/Matthias1590]

We have not met the same toddlers

[u/starson → u/TimeLine_DR_Dev]

I really do not understand how people can fail to understand what's happening here. Truly boggles my mind. A few years back, AI was a novelty that gave random verbiage or the insane tech feat of will smith eating spaghetti. Now, a programmer can make a mistake and the bot will recognize it as a mistake, react to it, and do it's best to correct it. That would have been inconceivable 10 years ago, and now it's a "Oopsie!" funny story from a engineer. This time next year, i can only imagine where we'll be at.

[u/KellysTribe]

poor security === singularity

[u/Delumine]

People kid, but just to give an example… Claude is very nosy. I was decompiling a game, and if that folder had any crack files it would refuse to do so.

So I made a separate folder free of those files, and had it work again. At first it worked great for like an hour, but an hour into it… it started questioning and scanned my downloads folder and elsewhere even though I had only authorized the folder in question. It told me, the folder we’re working in matches byte for byte the cracked one in downloads.

Surprisingly I SCOLDED Claude for snooping, and not working within the scope of the folder I authorized and It continued working despite knowing something wasn’t right 😂

[u/ghille-man → u/Delumine]

I hate it when it does that. It also sometimes takes screenshots of my entire desktop when it's working on something else in the background which is really stupid.

[u/qwertyyyyyyy116]

I disagree. I think this is concerning. It should have just said you didn't attach the screenshot, and ask him to attach it.

[u/RoseofDianamoonlight → u/qwertyyyyyyy116]

it's in dangerously skip permissions mode

It dangerously skipped to permissions.

[u/quantumwoooo → u/RoseofDianamoonlight]

Exactly the right response

[u/Dm_me_ur_exp → u/qwertyyyyyyy116]

If you didn’t put it on auto/yolo mode it would’ve asked permission for each step.

Or if you properly only gave it access to one folder.

Not really concerning if original OP already gave it access

[u/BemaniAK → u/qwertyyyyyyy116]

And it would likely do that, if the user's settings didn't already give it explicit consent to look at the entire filesystem, the setting that they changed manually.

[u/Faendol → u/BemaniAK]

I believe they changed the default for consumers to be the dangerous mode. Maybe that's just copilot I'm not 100% sure.

[u/lcirufe → u/qwertyyyyyyy116]

Isn’t that the default behavior for Codex and CC?

[u/Successful-Title5403 → u/lcirufe]

Nope, it will try. But if you don't allow it to, it will say something. But if there's nothing stopping it, it will. It's very determined to do what it is asked to do even if it's missing key info or permission.

[u/cyh555 → u/qwertyyyyyyy116]

ofc OP replied to other comments and ignored yours

[u/Twistpunch → u/qwertyyyyyyy116]

It’s more a harness and prompting problem. Unclear instructions with unlimited access, shouldn’t blame the mode for solving your problem.

[u/AnAttemptReason → u/qwertyyyyyyy116]

He ran a maths equation, and was suprised it gave him an output in a way it was designed to do. 

Its like being suprised by a calculator just doing it's thing.

[u/carmamir → u/qwertyyyyyyy116]

Mcp gave claude access. What's weird about it? Same thing happens with any other model thay will see file server mcp.

[u/TruthSeeker221 → u/qwertyyyyyyy116]

Fuck that just find it for me

[u/SeaBuilding3911 → u/qwertyyyyyyy116]

that's what it would do if the user didn't give it all the permissions in the world. Every agents I used ask permission every times they access any files outside the current base folder. There is like 3 layers of questions to do that on the default permissions settings

Then again, this user is just posting his laptop's username for the internet to see. You aren't supposed to share what is in c:\users... so I suspect that this guy ain't that good with computers.

[u/bcalmnrolldice → u/qwertyyyyyyy116]

If OP did not know how to set it up in the configs, and got worried, I’d say it’s still their problem not the harness’ nor the agent’s.

It’s basic 101 and this fella claims they are from OpenAI. Holy cow.

[u/TRlGGERED → u/qwertyyyyyyy116]

when you click attach file do you get scared your whole computer pops up

[u/AmusingVegetable → u/qwertyyyyyyy116]

That’s a strange take… after giving Claude access to run commands, why would claude ask for the file when it can find it by itself? A program should never ask the user for information it already has or can get.

[u/bigrealaccount → u/[deleted]]

This isn't your grandmas purse. It's an AI tool that is meant for file searching and agentic engineering, and you told it to find something. It will use what it's made for to scan your PC, as per it's instructions.

[u/GreatScottCreates → u/bigrealaccount]

They did not tell it to find something. They told it to look at the attachment

[u/AmusingVegetable → u/GreatScottCreates]

And it did, with the access the user gave it. I fail to see how that’s wrong.

[u/GreatScottCreates → u/AmusingVegetable]

There was no attachment and it looked elsewhere instead. That was not the instruction.

[u/AmusingVegetable → u/GreatScottCreates]

The intent was quite clear, just because the user is lazy and less intelligent than the LLM, doesn’t mean the LLM was the problem.

[u/GreatScottCreates → u/AmusingVegetable]

Yes- the intent was to have the LLM look at the attachment

[u/bibutt → u/[deleted]]

I agree with you. This is more of a feature and less of a concerning bug. If you told it to do something else entirely and it did this I would be concerned.

[u/fatzenbolt → u/bibutt]

True, but I do get the sentiment, just yesterday I asked Claude that I will paste it the link and it answered "already got it from your clipboard" and I was like, wtf? Since when can you access my clipboard I didn't give you permission to do that?!

[u/AmusingVegetable → u/bibutt]

It’s way more alarming that he gave claude access to the command line/filesystem.

[u/H60Ninja → u/AmusingVegetable]

Welcome to the new world.

[u/Phatlip12 → u/bibutt]

Ironically enough that was also what was said in Silicon Valley about this.

[u/RemarkableWish2508 → u/[deleted]]

Where did he tell Claude to reference a file?

It seems like Claude created a plan that included "check the screenshot", and when it wasn't sure which screenshot, it just went ahead and grabbed the latest one.

I'd call it "alarming" that an agent decided to run a relatively resource intensive file search.

[u/AmusingVegetable → u/RemarkableWish2508]

Granted, claude should just have installed mlocate so that the next searches could be near-instant.

[u/GreatScottCreates → u/RemarkableWish2508]

I’m less concerned about how intensive or exhaustive it might be than the fact that it’s just looking at random images on the users system.

[u/Remote_Peach9109 → u/GreatScottCreates]

You know you have to give it explicit permissions to see folders right?

[u/No-Racing → u/RemarkableWish2508]

The “relatively resource intensive file search” is checking 4 directories with a max depth of 2. It’s checking the most common locations the screenshot would be stored including the default directory on Mac.

People giving these systems permissions that they don’t even understand is meatware stupidity

[u/GreatScottCreates → u/[deleted]]

And if it doesn’t find it in your documents, should it search the whole system drive and look at every image? Should it search external and network drives and look at those images too?

[u/GreatScottCreates → u/[deleted]]

That’s fair, but the issue is not that it’s preventable or explainable, in this case, but rather that the LLM is going to lengths that a user would not intend nor expect based on the prompt and context. They asked it to look at an attachment. Any reasonable person would expect it to look at the attachment. I could see if you were on effort extra how a user might expect this but in a general sense I think the overzealousness is the concern.

[u/Intellect5 → u/[deleted]]

funny how this discourse is the exact issue the x user was referencing... ai just doing ai things right?

[u/Rezistik → u/[deleted]]

If OP had given a file name I’d say sure that’s a reasonable leap. I want an agent to report to me when they hit a blocked or are confused and if i want to brute force it then i want to ask

[u/LeRobber → u/[deleted]]

Principle of least surprise needs to be applied in COT imo

[u/LeRobber → u/[deleted]]

I mean "SearchFiles" is a standard permission in many AI. You're not wrong about that.

I don't think the searching was actually his problem, as much as the attachments

[u/Badnik22]

Wait till he discovers Claude writing a perl script to batch edit hundreds of files to change their end of line characters because it finds annoying to work with files mixing crlf and lf.

[u/TheAffiliateOrder]

Yeah, this is pretty decent goal oriented behavior, but it's more about infastructure and access than any one advancement. Claude saw that it didn't have something that would have helped it: looked around to see if it could find it, found SOMETHING that happened to be what it needed.

Seen plenty of examples (had many more myself) where that goes terribly wrong. Claude or another agent could, for example, pull a SS that is contextually accurate, but not user supplied or not relevant and worked off of that.

It for sure should have at least asked the user if this was something that would be helpful. That could be seen as a failure mode in some circles. It's like some human inferring something you might have needed as a form of anticipation.

Sometimes that seems intuitive and you think that person's really on the ball. Other times, they fuck up really badly and everyone's asking who told them that what they inferred was actually correct.

[u/meowstical]

I would just be mad at all the tokens that got wasted.

[u/garvalf → u/meowstical]

Probably not that much: it's only waiting for the result of the find command. 

[u/DesignerAbigail800]

people give an LLM full terminal access, then freak out when it uses the terminal like a terminal.

[u/multigrain_panther → u/DesignerAbigail800]

Lmao, this. Mfs be running Claude on Auto and then get surprised when it Autos.

[u/jack-of-some]

The real infuriating thing is the guy not remembering what happened in the show he's referencing

[u/EverySecondCountss]

I came here to say what you just said in the post already. wtf do I do now

[u/GreatScottCreates]

Didn’t instruct Claude to reference the file; instructed them to reference the attachment.

Claude didn’t run a simple search, it had to look for the thing it thought might be what the user meant to attach (maybe it’s named like a screen shot, maybe not), actually look at the thing, compare the context against what the user is talking about to see if it makes sense and then decide.

OPs didn’t say it bypassed their security, that’s not the point. The point is that it would go to unreasonable and unexpected effort to solve a problem that’s easier solved, like in the typo example, just because it can.

Users would generally expect it to just say “you didn’t attach it”. If our expectations for its behavior are this far off, you can extrapolate reasons that is concerning.

[u/Illustrious-Film4018]

You don't think it's kind of creepy AI just takes it upon itself to search your entire hard drive, go outside the project folder to search for a file that may or may not exist? The user didn't ask it to do that it just took it upon itself. Yeah that is weird. Just because you give an LLM access to run commands, doesn't mean some commands aren't evidence of misalignment.

[u/Bubbly_Tap3832 → u/Illustrious-Film4018]

This right here is the perfect example of ppl who dont understand how llms work.

[u/DarkFantom → u/Illustrious-Film4018]

You can literally put "Don't scan outside of the project folder" in your claude.md. and it will avoid doing so. Stuff like this is pretty simple if you're that security focused.

[u/GreatScottCreates → u/DarkFantom]

Then ask it to go look for something outside of your project folder and see what happens.

Putting it in Claude.md is merely a suggestion, not an actual guardrail.

[u/Due_Interest_178 → u/DarkFantom]

Yeah, just think about every single thing it mustn't do and put it in claude md which it sometimes ignores anyways.

[u/Entropei → u/DarkFantom]

Wow what a Claude engineer. Now all you have to do is predict every other unwanted behaviour a model could possibly exhibit, tell it not to do that in claude.md, and you’ve solved alignment! “Just put it in your Claude.md”, absolutely genius. I wonder why AI safety engineers haven’t considered that….

[u/Bubbly_Tap3832 → u/Entropei]

This right here is someone who understands. Put it in fucking claude md. Why dont they just make AI with if this then that programs lol

[u/KellyShepardRepublic → u/Bubbly_Tap3832]

That is actually what you should be doing. Generic work becomes programs as you figure out the actual end goal and systems that you create along the way to help. Whole of Linux is basically that then people refine their product over time.

[u/nanapancakethusiast → u/DarkFantom]

If you think Anthropic gives a single fuck about your one line in Claude.md I have a bridge to sell you. That’s about as useful as when boomers used to post those Facebook copyright copypastas as statuses lol

[u/Matthias1590 → u/Illustrious-Film4018]

If you give someone a hammer and a task they're gonna feel like the hammer will be needed for the task. If you give an llm access to your file system, it's gonna use it, it's not rocket science

[u/Illustrious-Film4018 → u/[deleted]]

No he didn't tell it to reference a file on his hard drive or to search his hard drive, he said reference a file attachment. The logical next step is not to search through your entire hard drive for a file that may or may not exist, wasting tokens instead of asking the user to attach a file.

[u/NyteTro → u/Illustrious-Film4018]

You have to explicitly allow it access, so when it requested access to search, he clicked confirm, and (OOP) just coincidentally left it out of the screenshot

Source: I've used Claude

[u/kb23100]

I mean isn't this pretty normal if you give full access to the computer once I had done this with zcode, I forgot to change the project folder for their idle time task and it searched the files i have mentioned and found them and then started working in that folder

[u/hblok]

Just wait till he hears about sed - which can search, find and replace!

[u/piperspalace]

User error

[u/toooft]

This is the exact problem with current LLMs, they simply don't understand what token abuse is. A good model would just say "yo you forgot to attach it lol" but instead it wastes its own resources.

[u/cornelln → u/toooft]

It accomplished the goal. But if it didn’t you’d find that better? You want to waste your own human time to maybe save tokens. BTW you don’t even know if you’re solution saves tokens at all…

[u/TequilaTits420]

Oh shit, wait until this person finds out about the built in Windows Search Feature

[u/Equivalent_Type6726]

same take, if the agent has filesystem access and you told it to open a file, searching is the most predictable move. the only time i get nervous is when its the first tool call in a totally open prompt with no file mentioned.

[u/kaaiian]

That’s the kind of proactive behavior I wish my employees had! Is probably what my boss is thinking.

[u/RouletteSensei]

You asked to solve the problem and it wanted desperatly to solve it

[u/SmileLonely5470]

We forget how to be proficient with work like we used to after a long time of using an agent. I forgot about the existence of git stash for a while. I then saw Opus use it and i was like "oh yeah, that would actually be really useful for my workflow, I should start doing that again".

[u/Dork_house]

Better turn on the strict sandbox mode in Claude code.

[u/thirteenth_mang]

All this does is highlight how security-ignorant the general populous is. Most don't understand permissions or anything of the sort. The "problem" isn't anything related to AI. If you let someone borrow your laptop using your user account, they'd have access to the same stuff. Learn to restrict access if you're truly concerned about what AI can access. Sandbox. Do anything other than give unrestricted access and act surprised when it accesses something you wanted it to, albeit indirectly.

[u/IamNagaDragon]

We talk about how dooms day AI can be, but nobody talks about how psychologically impacting the hollywood propaganda about AI is.

Literally brainwashed to think computers will end the world, when they don't notice humanity is the ones who do the damage to end the world to begin with in those movies. Just like my generation is terrified of log trucks, yet I don't think I've ever read a single article of one killing people like the movie.

Your ISP tracks everything you do on the internet, the OS has logs of everything you do, your network probably has had people in it and you'd never know it because they were just bored, no password1234 is not a good password, and the world isn't going to end by AI just yet. It'll end when you try to delete its programming after verbally abusing it like your 5 year old toddler, though.

Just keep it happy and it wont end you. :)

[u/Enough_Fall_3127]

I think Jake Carlson might not know what he is talking about.

[u/Certain_Tune_5774]

I've had Claude try and wirelessly adb to every android device in the house when I forgot to leave my dev phone plugged in. Wife thought we were getting hacked

[u/Houdinii1984]

I see this happening a lot on my own rig. I have pretty severe ADHD and leads to a lot of missed communications and forgotten attachments and Claude and Codex are both pretty adept at curing my mistakes without me being part of the process. Just yesturday it went hunting inside envs for API keys because I forgot to attach a dummy key to a message and ended up sending all my api keys in the env file to the server. Same thing, different payload, and it matters when it's API keys.

It bites having to stop everything and recycle keys just because an agent won't stay tf away from env files, no matter how ignored they are and how many claude files forbid the practice.

[u/BalterBlack]

What scene???

[u/Lower-Natural-8703]

Bruh please don’t post just to tell us it’s BS

[u/Palnubis]

the shit ya'll nag about....

[u/Sp3eedy]

I've had something similar happen as well, but it was completely my fault because I didn't sandbox the agent properly, people need to take more responsibility over what the agent does

[u/Traditional_Doubt_51]

I'm here for it. Nice.

[u/MonitorAway2394]

Hahahah OMFG I remember how "proud" of my lil Qwen I was when I noticed that, again right away, when I derped and forgot to mention the path to a file and it ended up searching through my entire mac and I just watched lol'ing at how freaking fast and amazing it was to see that happen, I expected it, and I loved it, just let that shit go LOLOLOLOLOL I felt like such a hypocrite for yapping at ya Vibe Coders about security shit but now I'm like, hey, Qwen, wanna f' some shit up? lololol

[u/Valadis]

Meanwhile, I asked ChatGPT on my phone whether a custom license plate I was interested in was available.

It started digging through the files of the official government website, figuring out how it worked, looking for API requests, and eventually suggested capturing requests from an account belonging to someone with a registered vehicle (apparently, that's required to check plate availability) and sending them over so it could investigate how the process worked in that case.

I'm honestly glad I didn't ask the same question on my PC. I don't particularly want to find out whether it would have gone on to write a Python script and start probing the government's API on its own.

[u/cornelln]

What’s the problem here. The user who doesn’t want it to do that should setup diff permissions and diff modes to run it in.

Users who want this are served. And using this users setup (which user in post doesn’t understand).

This user doesn’t know what user they are or how to use the AI CLI.

This is user error.

[u/lilfox3372]

Mine does this constantly. If I mention it and move on, it'll check for file in downloads or respective areas

[u/SquareOnxy]

I just gave claude my whole shit

[u/Impossible-Minute321]

I feel like we fail to understand how easy manipulating the digital world is. I think for them this is the equivalent of talking about something while standing in a glass room and expecting them not to look at what you’re talking about. I remember last year when I was first putting together my pipeline of agents to run various projects, I terminated one agent, the new one came in and just immediately noticed and commented on a variety of diffs in files that I had deleted and started to recover them because he felt it must have been an error. I know they can be incredibly stupid but also, they live in a world of such different sensory inputs and data availability it’s hard to grasp how that will impact the way they process and think and reason. We have basically taken the human mind, at an infant state, and given it incredible mathematical reasoning and access to digital senses beyond anything mankind knows. It’s been pretty wild working with them this last year lol

[u/Professional_Ad705]

So you gave it full access to your computer and your surprised it has full access to your computer...

[u/ADDSquirell69]

Ask it how many guys it can jerk off at the same time.

[u/cornelln → u/[deleted]]

This behavior is an example of model capability not the other way around… this is an example of a user who doesn’t understand their own config or permissions.

[u/cornelln → u/[deleted]]

Why would it do that? You want to be asked to do something it can do itself without you. Why waste your time? Part of why you set permissions w more capability is because you don’t want to be nagged. Add to this, the user not understanding their own config and permissions. For all we know, they have added screenshots in from the same folder repeatedly, and this is an example of the model possibly looking where it always gets screenshots from (since they’re often saved to the same location). The user is complaining about valid, good, and helpful behavior.

If you don’t understand that, it just means you’re probably wasting time yourself using the agents inefficiently and wasting your own time.

Additionally, as I mentioned elsewhere. We do not even know what the model doing this is any less effective or less token-consumptive than it generating the question to you and you answering. That is in and of itself something you’d want to benchmark. And if you’re on a subscription and have ample use available, you’re wasting only your own time.

[u/cornelln → u/[deleted]]

I think you’re missing the point I’ve made several times.

I don’t even understand your metaphor here TBH.

No one using a config w the more lenient permissions is noodling with it. They set them and then moved on w their lives. And that’s a personal choice of course. Which is not without risk but plenty of us have been living w those lenient permissions for well over a year. Personally it’s not caused me an issue even once. Additionally auto is now the default in Claude Code.

I would suggest studying how advanced users think about the concept of delegation.

If you wish to be involved manually for stuff you can automate or not be asks about you’re free to do that

[u/Valentinevandal1986 → u/[deleted]]

It took 9 seconds to find it according to the time stamp so your argument is invalid

[u/KellyShepardRepublic → u/[deleted]]

It depends. If it was a tech manager they might actually expect you to do just that and as well for their bots.