HackerNews中文版

最近我一直在评估 Agent 沙盒解决方案，突然意识到，对于允许 Agent 写入当前工作目录（CWD）的工具来说，存在一个巨大的持久性漏洞。我最初认为这没问题，因为我们可以审查 Git 差异中的所有内容。但后来我意识到，Agent 可以写入各种各样的文件，而我作为开发者，最终会在沙盒之外执行这些文件。例如，每个 .pyc 文件、.venv 中的文件、.git 钩子文件。 ChatGPT[1] 证实了潜在的漏洞，并指出在 Agent 沙盒工具的背景下，对此类问题的讨论并不多。我的结论是，唯一真正安全的沙盒技术是将文件从沙盒通过某种 Git 补丁或类似方式传输到开发者的机器上。也就是说，文件只有在版本控制中才能传输，因此，开发者在沙盒外传输之前，应该已经对其进行了审查。有什么想法或建议吗？ 1: https://chatgpt.com/share/69c3ec10-0e40-832a-b905-31736d8a3438

查看原文

I've been reviewing Agent sandboxing solutions recently it occurred to me there is a gaping vector for persistent exploits for tools that let the agent write to the CWD.I had originally thought this would ok as we could review everything in the git diff. But, it later occurred to me that there are all kinds of files that the agent could write to that I'd end up executing, as the developer, outside the sandbox. Every .pyc file for instance, files in .venv , .git hook files.ChatGPT[1] confirms the underlying exploit vectors and also that there isn't much discussion of them in the context of agent sandboxing tools.My conclusion from that is the only truly safe sandboxing technique would be one that transfers files from the sandbox to the dev's machine through some kind of git patch or similar. I.e. the file can only transfer if it's in version control and, therefore presumably, has been reviewed by the dev before transfer outside the sandbox.Thoughts or recommendations?1: https://chatgpt.com/share/69c3ec10-0e40-832a-b905-31736d8a3438

代理沙盒工具以读写模式挂载项目，存在严重的漏洞。