I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols.
Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.
This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.
Makes me want to have like 5 separate computers:
- one for banking only
- one for development only
- one for web browsing only
- one for gaming only
- one for socials only
How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
No need for something new here, Claude Code (Auto + default settings) has a tendency of running "find"/"ls" on your home folder when it struggles with solving a problem. I wish I was joking.
Now of course people trust these AI companies not to do bad things(tm), but all it takes is replacing the model endpoint URL -or any kind of harness compromise- and nothing will seem amiss
Will this even matter though? As long as these computers are on the same network, AI tools will find a way to get from one to the other if any of them are compromised
To do.. what exactly? Pay for my bills? I don’t know how it’s setup in your country but in mine that’s not realistic. Everything is handled on the app.
Lol, you mean like here in the UK where all banks are closing down branches left and right? I think my nearest one is a 45 minute drive away, and last time I went in they just directed me to a terminal that was basically my exact online banking interface and I had to log in the same way I would have done at home. I don't know what kind of query would warrant speaking to an actual teller. If you're regularly sending money or even want to check your balance this cannot be sustainable, would be an enormous waste of time.
How very considerate! Steal from the rich, not the poor.
Conversely, don't bother with poor people!
Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).
I’ve been thinking about how we’re still in the early days of agents, similar to the early days of the internet, happily opening up our machines and running new protocols.
Soon (now?) the threats will become ever more complex, and we’ll be back in the early-2000s-like virus storms.
This is the kind of stuff that keeps me up at night. Claude, ArtCraft, tons of other auto-downloading tools, are rolling 10'000's of code changes a month. If one compromised update snuck this guy in, it's kind of game over. The windows of opportunity for an attack like this seem to be widening the faster we "develop" software.
Makes me want to have like 5 separate computers:
- one for banking only
- one for development only
- one for web browsing only
- one for gaming only
- one for socials only
How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
> threat that exfiltrates
No need for something new here, Claude Code (Auto + default settings) has a tendency of running "find"/"ls" on your home folder when it struggles with solving a problem. I wish I was joking.
Now of course people trust these AI companies not to do bad things(tm), but all it takes is replacing the model endpoint URL -or any kind of harness compromise- and nothing will seem amiss
Will this even matter though? As long as these computers are on the same network, AI tools will find a way to get from one to the other if any of them are compromised
If there is no way to disable auto-update the application goes in the bin.
I sandbox my dev environment.. hopefully that protects at least a little bit.
What do you use?
VMs would work pretty well.
100% agree. Developers are playing with fire regarding cookie stealers, malware, data exfiltration.
Ideal setup:
- Dev machine
- Gaming machine (isolate downloading mods)
- Browsing machine
... but, but, sama says we having his RAM is bad! And now you want 5, not 1 of 'em precious compute receptacles!
Isn’t this common knowledge that there are computers you use for banking, computers you use for windows 98 and computer you use for gaming?
For banking I use macOS/linux, sometimes iOS unfortunately but we all do sins
For banking, you can avoid computers and just go in.
To do.. what exactly? Pay for my bills? I don’t know how it’s setup in your country but in mine that’s not realistic. Everything is handled on the app.
Lol, you mean like here in the UK where all banks are closing down branches left and right? I think my nearest one is a 45 minute drive away, and last time I went in they just directed me to a terminal that was basically my exact online banking interface and I had to log in the same way I would have done at home. I don't know what kind of query would warrant speaking to an actual teller. If you're regularly sending money or even want to check your balance this cannot be sustainable, would be an enormous waste of time.
I mean this is the basic premise behind QubesOS, but if you add isolation like Qubes wants, it does become very difficult to cross between apps.
Maybe consume less sensationalist newsbits :P.
“ Makes me want to have like 5 separate computers”
You forgot one.
Good. LLMs aren't very good at that.
What makes you say that? It's good enough
How very considerate! Steal from the rich, not the poor.
Conversely, don't bother with poor people!
Now we just need proper Robin Hood malware that "levels out the playing field" as it were, by stealing from the rich and moving that money into the poor people's accounts (that have also been hacked).
I'm just imagining some poor person getting a call about 100,000$ that's been transferred to their account without any idea how or why.