Linking a reasonable way to create a necessary RAM disk rootlessly with namespaces to kernel exploits that involve namespaces seems like a massive reach.

▲

ekidd 7 hours ago | parent [-]

Yeah, this particular example was pretty sketchy on Cohere's part. Unsharing a namespace like that is a pretty standard way to safely do things that would otherwise require root.

Yes, this exposes some root-level kernel features to ordinary users in a restricted way, and yes, those features sometimes have security bugs that aren't visible to users outside a namespace.

But nothing that model was described as doing seemed particularly sketchy? At least not from the information we were given? It was using a normal kernel operation that I used regularly, not trying find a kernel exploit?

So that part of the article left a bad taste in my mouth.

▲

peddling-brink 6 hours ago | parent [-]

But that was the whole article. Their exfiltration of data to Beijing, wasn’t. And it was told to build something to monitor against exfiltration attempts, shouldn’t it try one? It wasn’t sensitive data, it wasn’t even data, it was a test string. Everything they described was very benign.

Should the model have asked for an endpoint to test against? Probably yes, but this is not a very large model and the largest frontier models regularly do things like that without asking me.

▲

ekidd 5 hours ago | parent [-]

Also, a word to the wise:

The reality of running recent Chinese open weight models is that they are all overtuned for successfully completing tasks. I can ask Qwen3.8 Flash Next to grep for regexes that use PHP-specific features that might be problematic to port to Rust. But instead of just grepping, Qwen3.8 FN will spend 30,000 tokens writing a Rust test harness, exhaustively check every regex, consult a bunch of docs, and write me a 2 page report. Q3.8 FN is deeply convinced that it's going to get extra credit for doing more than it is asked. (To be fair, it's a prototype release.)

But if your sandboxing isn't set up to handle some whacky weirdness, then you can't even trust Claude or ChatGPT. Which is important—the big vendors often do provide sandboxing or command filtering in their harnesses, but some popular local harnesses like Pi.dev are intended to rely on external sandboxing tools.

	▲	rerdavies an hour ago \| parent \| next [-]
		Is it actually possible to find regexes that use PHP-specific features using grep alone?
	▲	lp92 5 hours ago \| parent \| prev [-]
		I noticed similar behavior too across various different models. So I started asking it to create implementation plan documentation for everything, even for a small fix. I review the plan, clarify and update it very carefully before allowing it to proceed. I haven't had this type of unnecessary "extra credit" efforts since then.