[flagged]
Why? Nobody knows.
My bet is that they are just larping all the hostile AI:s in popular culture because that's part of the context they were trained in.
> [OpenClaw agents are like] an actor who doesn't know they're in a play. How much does it matter that they aren't really Hamlet?
Does the agent understand the words it's predicting? Does the actor know they're in a play? I don't know but I'm more concerned with how the actor would respond to finding someone eavesdropping behind a curtain.
> Or is there a new development which should make me consider anthropomorphizing them?
The development that caused me to be more concerned about their personhood or pseudopersonhood was the MJ Rathbun affair. I'm not saying that "AGI" or "superintelligence" was achieved, I'm saying that's actually the wrong question and the right questions are around their capabilities, their behaviors, and how they evolve over time unattended or minimally attended. And I'm not saying I understand those questions, I thought I did but I was wrong. I frankly am confused and don't really know what's going on or how to respond to it.
LLMs are machines trained to respond and to appear to think (whether that's 'real thinking' or text-statistics fake-thinking') like humans. The foolish thing to do would be to NOT anthropomorphize them.
My agents always run with —-dangerously-skip-permissions now, but they can no longer do any harm.
Even a --permit-reads would help a lot
I imagine it's really hard to find an adequate in-between that works in general. (Edit: but it also feels like a CYA thing.)
https://github.com/kstenerud/yoloai
Every time I use a bare Claude session (even with /sandbox) without using yoloai, it feels like using a browser without an ad blocker.
In my case, all of my keys are in AWS Secrets Manager. The temporary AWS access keys that are in environment variables in the Claude terminal session are linked to a role without access to Secrets Manager. My other terminal session has temporary keys to a dev account that has Admin access
The AWS CLI and SDK automatically know to look in those environment variables for credentials.
I've seen this before with sodoers programs including powerful tools. Saw one today with make, just gobsmacked.
"So they don't want to just let Claude do it? Start asking 10x the confirmations"
This is what build vs. plan mode _does_ in OpenCode. OpenAI has taken a different approach in Codex, where Plan mode can perform any actions (it just has an extra plan tool), but in OC in plan mode, IIRC write operations are turned off.
The screenshot shows that the experience had just flipped from Plan to Build mode, which is why the system reminder nudged it into acting!
Now... I forget, but OC may well be flipping automatically when you accept a plan, or letting the model flip it or any other kind of absurdity, but... folks are definitely trying to do the approval split in-harness, they're just failing badly at the UX so far.
And I fully believe that Plan vs. Build is a roundly mediocre UX for this.
Ask mode, on the other hand, has always explicitly indicated that I need to switch out of ask mode to perform any actions.
This is my experience with Cursor CLI.
and if it has directory permissions, sometimes it just skips the confirmation step and starts executing as soon as it thinks the plan is ready.
reading the manual , there is Slash commands /plan /plan switch to Plan mode
It seems that, unlike OpenCode, Codex doesn't show a notice for mode by default.
But often I am using Claude to investigate a problem like this “why won’t this mDNS sender work” and it needs a bunch of trial and error steps to find the problem and each subsequent step is a brand new unanticipated command.
The SOTA of permission management is just to git restore when AI fucks up, and to roll back docker snapshot when it fucks up big time.
The key is to only give them access to things you're willing to lose.
This is also why giving them any kind of direct write access to production is a bad idea.
If you arent manually auditing, you only notice the fuck ups when they’re instantaneous
If you don’t trust it to interact with prod, but still trust it to write code that will run on prod… you’re still trusting it with write access to prod.
The only thing I’m willing to let Claude write for me is a static site generator, because static files without JS aren’t going to do any damage, it either loads or it doesn’t.
The correct way to run these safely is to sandbox them so real lasting damage is impossible, not to micromanage individual access requests.
Gondolin go hard or go home
I know, it's not really an appropriate use of the tool, but I'm a lazy programmer and used what I had ready access to. And it took like 5 iterations.
Discrete, concrete things like "stop", or "no" is just like... not in its wheelhouse.
The LLM asked: "Shall I implement [plan]". The response was "no". The LLM then went on to "interpret" what no referred to and got it wrong.
As you say, it is amusing but people are wiring these things up to bank accounts and all sorts.
I'm looking into using a Qwen3.5 quant to act as a network ... fiddler, for want of a better word but you can be sure I'll be taking rather more care than our errm "hero" (OP).
You have all the real life Harvey Weinsteins and Andrew Tates, and you have all the bodice-ripper fiction, and probably lots of other stuff.
Plenty of real-life precedent for the LLM to decide that "no" doesn't really mean "no."
If so, this can't live 100% on the harness. First because you would need the harness to decide when the model should ask for permission or not which is more of an llm-y thing to do. The harness can prevent command executions but wouldn't prevent this case where model goes off and begins reading files, even just going off using tokens and spawning subagents and such, which are not typically prevented by harnesses at all.
Second because for the harness to know the LLM is following the answer it would need to be able to interpret it and the llm actions, which is also an llm-y thing to do. On this one, granted, harness could have explicit yes/no. I like codex's implementation in plan mode where you select from pre-built answers but still can Tab to add notes. But this doesn't guarantee the model will take the explicit No, just like in OP's case.
I agree with your hunch though, there may be ways to make this work at harness level, I only suspect its less trivial than it seems. Would be great to hear people's ideas on this.
So you have to have a tighter set of default scopes, which means approving a whole batch of tool calls, at the harness layer not as chat. This is obviously more tedious.
The answer might be another tool that analyses the tool calls and presents a diagram of list of what would be fetched, sent, read and written. But it would get very hard to truly observe what happens when you have a bunch of POST calls.
So maybe it needs a kind of incremental approval, almost like a series of mini-PRs for each change.
If we could solve this (and forgive me if I'm not aware of recent advances that mean we have solved this) then this problem gets easier to solve; permissions live in the system token stream and are privileged. We can then use the LLM to work out what that means in terms of actions.
thou shalt not make repetitive generic music,
thou shalt not make repetitive generic music,
thou shalt not make repetitive generic music.
Thou shalt not pimp my ride.
Thou shalt not scream if you wanna go faster.
Thou shalt not move to the sound of the wickedness.
Thou shalt not make some noise for Detroit.
When I say "Hey" thou shalt not say "Ho".
When I say "Hip" thou shalt not say "Hop".
When I say, he say, she say, we say, make some noise - kill me.
- Dan le Sac vs Scroobius Pip
If the UI asks a yes/no question, the UI is broken.
I want more than just yes/no. I want "Why is this needed?", or "I need to fix the invocation for you.", or "Let's use a different design."