Hacker News Reader

> Normally if LLMs want to compose multiple operations, they have the perfect tool for this: bash, or whatever other OS shell is available.

I many scenarios, e.g. running the harness server-side, as is the case for chat interfaces, you don't really want to expose OS shell access as that opens up a huge security attack surface.

View on HN

> I many scenarios, e.g. running the harness server-side, as is the case for chat interfaces, you don't really want to expose OS shell access as that opens up a huge security attack surface.

It does, but a restricted user account mitigates the large majority of those issues. A sandbox mitigates even more.

The number of remaining exploits left is probably going to be the same as the number in the harness. More, in fact, as many of them have no human review anyway.

You can give the LLM a bash without giving it the full /usr/bin.

That's been a trivially solved problem for decades.

That has been one of the most common exploits for decades.

And as a result it is the most hardened.

So how do you explain it still being in the "OWASP Top 10" and the "CWE Top 25 Most Dangerous Software Weaknesses"?

Yes, and also MCP does literally nothing to prevent these sorts of exploits.

Like I said, AI bros vibecoding slop because they literally have no clue what they're doing.

Reply on news.ycombinator.com