Should Claude have access to user details? I’d say no, unless explicitly entered manually into a chat.
Should Claude have access to anything outside of the sandboxed project files without explicit permission? I’d again say no.
Should Claude have internet access without a clear log of all requests made?
Instances of Claude should be heavily sandboxed and kept away from user data, far more so than they are now. The impression given by the desktop UI is that the LLM only has access to things explicitly added to a project.
This impression is not true, as evidenced by Claude pulling data from other sessions outside a project even when not instructed to (I’ve seen this a few times), and in this case pulling your email (from account details, user contacts? I wonder where it got that info?).
None of this information should be available to Claude, by design, not by instruction. Using text instructions to try to limit these machines is an incredibly flawed approach and should not be necessary for important info. Anthropic should have the model access completely locked down by controls at the os level over file access, not open by default. That is how to fix this.
If a user wants to open access that should be an explicit choice from them, with a warning about possible consequences.
This is hard to avoid. All it needs to do is make a git commit and look in the git log and it will find out who you are.
This is definitely a question that sounds straightforward but isn't. Like, when I ask antigravity to commit to git, it gets an error because ~/.gitconfig is outside the sandbox.
I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.
It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.
As always feedback is wellcomed
Launch script checks that I can't accidentally run them with a working dir too far out (i.e. user folder).