Hacker News Reader

Access to read sensitive files and access to internet could easily lead to data exposures on the internet, no? Without any terminal or shell access.

View on HN

Yes, but what I'm saying is that it is much easier to put a limit on the read_file tool or the http tool rather than sandboxing your whole environment.

You only really need to sandbox when you provide access to tools that are almost impossible to filter correctly, such as a bash tool or a tool for arbitrary code execution.

Limiting it to just read and http limits its usefulness. If you want something like “filter for this, count the number of matches, format like this” you have to make custom tools. And you have to make sure they don’t have any bugs that allow arbitrary code execution. You’re effectively building your own sandbox in this case. Using a standard one sounds easier unless you have a very focused use case.

Reply on news.ycombinator.com