So what?

It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work.

Claude Code is the most amazing and game changing tool I've used since I first used a computer 30 years ago. I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.

▲

OJFord 5 days ago | parent | next [-]

It doesn't have to be a deliberate 'attack', Claude can just do something absurdly inappropriate that wasn't what you intended.

You're absolutely right! I should not have `rm -rf /bin`d!

▲

saberience 5 days ago | parent | next [-]

I would say this is a feature, not a bug.

Terminal and Bash or any shell can do this, if the user sucks. I want Claude Code to be able to do anything and everything, that's why it's so powerful. Sure, I can also make it do bad stuff, but that's like any tool. We don't ban knives because sometimes they kill people, because they're useful.

▲

OJFord 5 days ago | parent | next [-]

I would say it's neither, it's complacent misuse by the user. As you allude to we generally already are, but non-deterministic & especially 'agentic' AI makes the stakes/likelihood of it going wrong so much higher.

Don't use an MCP server with permission (capability) to do more than you want, regardless of whether you think you're instructing the AI tool do the bad thing it's technically capable of.

Don't run AI tools with filesystem access outside of something like a container with only a specific whitelist of directory mounts.

Assume that the worst that could happen with the capability given will happen.

▲

zahlman 5 days ago | parent | prev [-]

> Terminal and Bash or any shell can do this, if the user sucks.

But at least they will do it deterministically.

	▲	vel0city 5 days ago \| parent [-]
		In my experiences users are often far from deterministic.

▲

bethekidyouwant 5 days ago | parent | prev [-]

I don’t use Claude, but can it really run commands on the cli without human confirmation? Sure there may be a switch to allow this but If in that case all but the most yolo must be using it in a container?

	▲	mr_mitm 5 days ago \| parent \| next [-]
		There are scenarios in which you allow it to run python or uv for the session (perhaps because you want it to run tests on its own), and then for whatever reason it could run `subprocess.run("rm -rf / --no-preserve-root".split())` or something like that. I use it in a container, so at worst it can delete my repository.
	▲	0x3f 5 days ago \| parent \| prev \| next [-]
		By default it asks before running commands. The options when it asks are something like [1] Yes [2] Yes, and allow this specific command for the rest of this session [3] No
	▲	stagalooo 5 days ago \| parent \| prev [-]
		One easy way to accidentally give Claude permission to do almost anything is to tell it that it’s allowed to run “find” without confirmation. Claude is constantly searching through your files and approving every find command is annoying. The problem is, find has a --exec flag that lets it run arbitrary bash commands. So now Claude can basically do anything it wants. I have really been enjoying Claude in a container in yolo mode though. Seems like the main risk I am taking is data exfiltration since it will has unfettered access to the internet.

▲

CGamesPlay 5 days ago | parent | prev [-]

> I couldn't give two fucks about its "vectors of attack", none of them matter if no one has unauthorized access to my computer, and if they do, Claude Code is the least of my issues.

Naive! Claude Code grants access to your computer, authorized or not. I'm not talking about Anthropic, I'm talking about the HTML documentation file you told Claude to fetch (or manually saved) that has an HTML comment with a prompt injection.