Claude does clearly stupid things, even under auto mode, that no human would reasonably do. I had a sustained 500mb/s ingress to my machine that turned out to be a background "find /" command on a multi-petabyte NFS system. I've now gotten serious about my deny lists, and it trips all the time.
The worst is when it works around the deny list by running an equivalent command like "bfs /" or just writes itself a script.
I wish we would get better sandboxing than more "safeguards", but the direction things are going seems inspired by craw.
The real question here is why youre freely running it on a system and dont have it sandboxed in some way. Literally the first thing i did the day i signed up for an ai subscription.
I have a base docker container and a shell script that "customizes" each instance for where its running (making sure user id matches for permissions, etc). Runs as non root in container, has minimal privileges, and only access to the repo or dir where the shell script was called
You definitely let the ai shoot your legs off all on your own.
I've used auto mode a few times and it's honestly pretty good, but I think this isn't just about auto mode, CC in particular has many other safeguards I've noticed even when not under auto mode (one that surprised me recently is a "risky command detected" that under bypass permissions stopped a tool call - the script had a RM /$var - had the var been empty somehow, it could've deleted the os).
I'm not surprised they are confident in promoting it to the default, it alongside the many other safety features in the tooling are honestly probably better than my exhausted review of every action.
Auto mode denies are also interesting, sometimes Claude wants to go off script to double check something (ie: waste time checking something slightly related that I know is not necessary/truth holds) and auto mode plainly stops it since it's off scope, nice bonus.
> the script had a RM /$var - had the var been empty somehow, it could've deleted the os
I had something almost identical that was missed by Auto Mode a couple of days ago, but thankfully not with the same failure mode. It was copying files into another directory, but $var was never set by the script Claude wrote. So instead of copying across the few files it had intended to, for a few minutes Claude was happily recursively copying from the root of the filesystem into this folder. Luckily the operation timed out while I was away from computer, and I came back to a horrified Claude stating "I need to be honest here".
Claude does clearly stupid things, even under auto mode, that no human would reasonably do. I had a sustained 500mb/s ingress to my machine that turned out to be a background "find /" command on a multi-petabyte NFS system. I've now gotten serious about my deny lists, and it trips all the time.
The worst is when it works around the deny list by running an equivalent command like "bfs /" or just writes itself a script.
I wish we would get better sandboxing than more "safeguards", but the direction things are going seems inspired by craw.
The real question here is why youre freely running it on a system and dont have it sandboxed in some way. Literally the first thing i did the day i signed up for an ai subscription.
I have a base docker container and a shell script that "customizes" each instance for where its running (making sure user id matches for permissions, etc). Runs as non root in container, has minimal privileges, and only access to the repo or dir where the shell script was called
You definitely let the ai shoot your legs off all on your own.
I've used auto mode a few times and it's honestly pretty good, but I think this isn't just about auto mode, CC in particular has many other safeguards I've noticed even when not under auto mode (one that surprised me recently is a "risky command detected" that under bypass permissions stopped a tool call - the script had a RM /$var - had the var been empty somehow, it could've deleted the os).
I'm not surprised they are confident in promoting it to the default, it alongside the many other safety features in the tooling are honestly probably better than my exhausted review of every action.
Auto mode denies are also interesting, sometimes Claude wants to go off script to double check something (ie: waste time checking something slightly related that I know is not necessary/truth holds) and auto mode plainly stops it since it's off scope, nice bonus.
> the script had a RM /$var - had the var been empty somehow, it could've deleted the os
I had something almost identical that was missed by Auto Mode a couple of days ago, but thankfully not with the same failure mode. It was copying files into another directory, but $var was never set by the script Claude wrote. So instead of copying across the few files it had intended to, for a few minutes Claude was happily recursively copying from the root of the filesystem into this folder. Luckily the operation timed out while I was away from computer, and I came back to a horrified Claude stating "I need to be honest here".
Auto mode is already appearing on claude.claude advised us to use sonnet 4.6 for deep coding with less tokens used