Honestly, this feels like a massive step back. When I use an agent, I'm not just a user, I'm a supervisor. I need observability. If Claude starts digging into node_modules or opening some stale config from 2019, I need to know immediately so I can smash Ctrl+C
Hiding filenames turns the workflow into a black box. It’s like removing the speedometer from a car because "it distracts the driver". Sure it looks clean, but it's deadly for both my wallet and my context window
I'm not sure it's just fear of lawyers, although that's definitely part of it. Big companies have way more to lose reputationally and legally, so the bar for releasing something is much higher
Most current "voice assistants" still feel like glorified walkie-talkies... you talk, pause awkwardly, they respond, and any interruption breaks the flow
Rewriting the main goal every morning is a nice way to prevent "local optimization," where you get very efficient at doing things that don't actually move the project forward
The difference to me is that 5S is about making a shared environment predictable and efficient, while what the article describes feels more like a personal cognitive reset
I don't think LLMs are the root cause or even a dramatic inflection point. They just tilt an already-skewed system a little further toward motion over judgment
We're pretty good at naming fear when it has a physical trigger. We're much worse at naming the unease that comes from watching something you care about get quietly hollowed out over time. That doesn't make it melodrama, just a different category of discomfort.
The data center buildout feels obscene when framed this way. Not because computation is evil, but because we're burning planetary-scale resources to accelerate a culture that already struggles to articulate why quality matters at all
Unless you use --unshare-net, bwrap leaves the network wide open by default. The agent can not only accidentally delete a file, but also exfiltrate keys or download a malicious package
As a next step I'd add a network namespace (--unshare-net) and spin up a local HTTP proxy (mitmproxy) inside the sandbox to allow access only to Anthropic APIs and maybe PyPI/NPM, while blocking everything else
dockerd is a massive root-privileged daemon just sitting there, waiting for its moment. For local dev it’s often just unnecessary attack surface - one subtle kernel bug or namespace flaw, and it’s "hello, container escape". bwrap is much more honest in that regard: it’s just a syscall with no background processes and zero required privileges. If an agent tries to break out, it has to hit the kernel head-on instead of hunting for holes in a bloated docker API
Anthropic is pushing MCP for a reason. The idea is to spin up a local MCP server that serves project context - docs, architectural decisions, DB schemas - which Claude Desktop and Cursor (via plugins or natively soon) can connect to
For a team this is a total killer feature: you spin up a shared MCP server with documentation, and all agents instantly sync their "brains"
It's wild that we live in an era where computers are doing real-time ML inference and firmware updates over USB-C, but basic error reporting has regressed to "something happened, good luck"
There's a hidden trade-off here: Latency vs Privacy
A local agent has zero ping to your smart home and files, but high latency to the outside world (especially with bad upload speeds). A cloud agent (Cloudflare) has a fat pipe to APIs (OpenAI/Anthropic) and the web, but can't see your local printer.
The ideal future architecture is hybrid. A dumb local executor running commands from a smart cloud brain via a secure tunnel (like Cloudflare Tunnel). Running the agent's brain locally is a bottleneck unless you're running Llama 3 locally
"The Internet woke up and started buying Mac Minis"
Cloudflare: Hold my beer, we'll run it in the cloud.
The irony is that the whole point of the "self-hosted" movement was leaving the cloud to own your data and compute. Cloudflare suggests moving it back to the cloud but labeling it Serverless. Technically elegant, but ideologically funny
Though honestly administering Kubernetes at home gets old faster than paying $5 a month
Copy that, Zero-Knowledge is the gold standard, kudos. But this brings us back to the Supply Chain risk
If the agent (writing the code) is in YOLO mode, the risk shifts from "runtime exploitation" to "build-time backdoor injection". Hypothetically an agent could "accidentally" weaken the RNG in your crypto layer or leak keys via JS console logs. So isolating the dev environment here protects the integrity of your ZK promise
Looking forward to the Show HN on the tool itself!
I should clarify, not "malicious" in the sense of "wants to hack you", but "dangerous" by nature. AI loves to hallucinate non-existent packages (hello, supply chain attacks), hardcode credentials, or disable SSL verification simply because it makes the code work. It's not evil, it's just competently ignorant, which in a security context is often worse than an overt enemy
As soon as a system gives you a receipt, a cryptographic proof, or even a reliable way to re-verify later, you've created something that can usually be repurposed as evidence for a third party
This feels like one of those cases where the technical consensus has been clear for years, but the policy and media narratives keep resetting to "maybe this time it's different."
The only real solution here is a strict egress filtering. The agent can fetch packages (npm/pip) via a proxy, but shouldn't be able to initiate connections to arbitrary IPs. If the agent needs to google, that should be done via the Supervisor, not from within the container. Network isolation is more reliable than content analysis