🛡️ Security Hub

[smolcompute]

PAI, being powered by coding agents working locally on your machine, is inherently vulnerable to the lethal trifecta.

ie., the combination of :

• File system access (private data)
• Untrusted content, potentially ubiquitous (prompt injection )
• Network access (data exfiltration)

If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.

Please share your security setups, best practices, tips and tricks to keep everyone safe 🙏.

How do you protect yourself ?

Tell us and let's discuss 👇

[smolcompute]

Some useful links

Claude Code Security

Claude Docs

• https://docs.claude.com/en/docs/claude-code/security
• https://docs.claude.com/en/docs/claude-code/sandboxing
• https://docs.claude.com/en/docs/claude-code/iam
• https://docs.claude.com/en/docs/agents-and-tools/tool-use/web-fetch-tool

Github Sandboxing Repo

• https://raw.githubusercontent.com/anthropic-experimental/sandbox-runtime/refs/heads/main/README.md

Anthropic Engineering Blog

• https://www.anthropic.com/engineering/claude-code-sandboxing

Codex Security

Codex Developers Docs

• https://developers.openai.com/codex/security
• https://developers.openai.com/codex/local-config#cli
• https://developers.openai.com/codex/cli/reference

Github Sandboxing doc

• https://github.com/openai/codex/blob/main/docs/sandbox.md#platform-sandboxing-details

Security Articles

• https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
• https://simonwillison.net/2025/Oct/22/living-dangerously-with-claude/
• https://simonwillison.net/2025/Aug/9/bay-area-ai/
• https://simonwillison.net/2025/Jun/13/prompt-injection-design-patterns/

[smolcompute]

@danielmiessler I would really like to know how you have configured PAI to run safely in your machine ?

Personally, I hope to avoid docker containers all together, but I don't see any real way to defend against the lethal trifecta besides severely restricting network access to PAI which is a huge handicap...

[Wayku7]

Personally, I currently use a Docker container and I control access to the Internet. The permission configurations are all the time on demand. And even then, I'm avoiding using it to go online. When I have queries, searches to do, I use another web LLM. We're going to say a big, well-known model for going and answering questions. After that, I bring the information back in Markdown format to my ecosystem to my agent.
But indeed, I am trying to avoid minimizing the risks at the moment, but it is clearly that there are issues at stake. And then also, I didn't configured MCP because I'm not enough about them.

But I'm still happy to use a Docker Container because it's like a double protection. And yes, theoretically, Claude says that he is limited to only the repertoires that he has been given access. But with the Docker Container, clearly, it prevents him from walking around the system. And I give him access to only the data directory I want. There's no access to everything, but at the same time, given the use I make of it over time, this directory of data that has access to is going to become really sensitive anyway. So, there are still issues at stake at this level.

[smolcompute]

Yeah. Docker seems a secure solution for isolation. However, if you start adding private data you want your DA to know about you, and also want it to be able to use the web to take action for you, you're quickly reintroducing vulnerabilities.

I really want to be able to delegate a lot of web research to my agent. I don't want to have to manually switch from the consumer apps for research and paste the results back into PAI.

Right now, it looks like the only way to run PAI truly securely is to use it with no network access whatsoever to cut off the exfiltration leg of the trifecta (+ exclude dangerous commands). But that's obviously not what most people want from their DA.

[danielmiessler]

I'm working on various security layers. Right now they're largely prompt based, which are decent but not great. Eventually I'll have a completely separate environment for running the whole stack.

…

On Fri, Oct 31, 2025 at 2:56 AM, smol compute < ***@***.*** > wrote: @ danielmiessler ( https://github.com/danielmiessler ) I would really like to know how you have configured PAI to run safely in your machine ? Personally, I hope to avoid docker containers all together, but I don't see any real way to defend against the lethal trifecta besides severely restricting network access to PAI which is a huge handicap... — Reply to this email directly, view it on GitHub ( #71 (comment) ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AAAMLXUICV2KYFNAHQ5CUHD32K6VLAVCNFSM6AAAAACKXIMPDWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTIOBTGI4TOMI ). You are receiving this because you were mentioned. Message ID: <danielmiessler/Personal_AI_Infrastructure/repo-discussions/71/comments/14832971 @ github. com>

[evenromo]

This was an interesting read:

https://simonwillison.net/2025/Nov/2/new-prompt-injection-papers/#atom-everything

[smolcompute]

My current setup to allow PAI to run bash without approval:

• None of the apps I use for PAI (Cursor and Warp mostly) have access to any TCC protected paths
• I have moved PAI out of ~ and into /Users/Shared/
• edit and write is set to deny pretty much everywhere but /Users/Shared/
• Read to ~ is set to ask
• I add domains to the allowlist as I go.
• A whole list of deny dangerous or unnecessary bash commands,

Not sure if this makes sense, if anyone has thoughts feel free to let me know.