qarl2

Is that really the take away?

I think the real take away is that audiences want good movies. The Odyssey is a good movie - it just so happens to be made the hard way.

(Or, in other words, correlation does not imply causation, and that's all this article has.)

Oh good - so you don't see the agents themselves as inherently sloppy - that's just how they're being used by some people.

Because I must warn you - it's extremely easy to ask a coding agent to prove code correctness before committing his work.

And why don't they simply run that software on the laptop they already own?

What is it about THIS software, unlike any dev software to come before it, that pushes people to buy new small computers?

Why do you think?

I don't honestly believe that the allowlist isn't (naively) intended to be there for security. It's certainly not a very useful ux for providing LLM guidance: prompts, memories & AGENTS.md already provide an avenue for this & having it in a formalised, structured format isn't conducive to LLM guidance.

If you had any experience with using LLM harnesses, you would be aware that despite instructions (in prompts, AGENTS.md, etc.) the agents will sometimes ignore those instructions.

One solution to remind the agents is to explicitly disallow their instruction-violating attempts.

This is how allowlists are used to guide agent behavior.

You should try it sometime before you speak authoritatively about it further.

And now you shift the goalposts.

All of the harnesses I cited above run locally and default to testing the code they generate, despite your inability to conceive of it.

It is very obviously the primary use case: automated development interleaved with investigation. Because you need to do both, at the same time, iteratively.

Please don't make me paste those URLs again: they demonstrate exactly what you say does not happen.

It does not need to be on the same system - but that is currently how it is done by nearly everyone in the field because it seems to be the most effective way. Which is why coding harnesses build AND execute code.

I'm not sure why you disbelieve agents can do "guaranteed to never fail". Proving correctness is one of their strengths. Proofs in general, in fact, much much better than the typical human coder.

Well - maybe. But as I understand it - you can't buy Mac minis right now because agentic coders are buying all of them, so they can properly sandbox their agents. Which means a LOT of people know they need to sandbox their agents.

I'm beginning to think that the true issue here is that people who dislike AI are largely ignorant of the current state. Because willful ignorance.

I say that because I repeatedly see people making extremely silly statements that they really should know better about. But for some reason they don't.

Obviously I could be wrong. Time will tell.

In fact I'm genuinely struggling to think of any scenario where an agent CLI would need to execute a build artifact.

You should look into "testing". It's when you run the code you just wrote to make sure it works.

For example, in LLM harnesses, it's used to ensure the produced code has the desired properties. It is the key element needed to allow agents to continue to work until they have succeeded.

Anthropic's harness Claude Code:

https://code.claude.com/docs/en/best-practices — "Claude does the work, runs the check, reads the result, and iterates"

https://www-cdn.anthropic.com/58284b19e702b49db9302d5b6f135a... — "autonomous loops where Claude writes code, runs tests, and iterates continuously"

https://www.anthropic.com/research/long-running-Claude — "Run pytest tests/ -x -q before every commit"

https://platform.claude.com/docs/en/agents-and-tools/tool-us... — "Claude edits a file with one tool and requests the command that runs it"

https://platform.claude.com/docs/en/agents-and-tools/tool-us... — "writes Python with the file operations sub-tool and runs it with a Bash command"

OpenAI's harness Codex:

https://openai.com/index/introducing-codex/ — "can iteratively run tests until it receives a passing result"

https://openai.com/index/introducing-upgrades-to-codex/ — "iterating on its implementation, fixing test failures, and ultimately delivering a successful implementation"

Aider harness:

https://aider.chat/ — "Automatically lint and test your code every time aider makes changes"

https://aider.chat/docs/usage/lint-test.html — "run your test suite after each time the AI edits your code"

Devin harness:

https://cognition.com/blog/introducing-devin — "Devin writes and debugs code to run a computer vision model"

https://cognition.com/blog/introducing-devin-2-2 — "Devin runs through your app and sends back screen recordings"

https://cognition.com/blog — "Devin now builds, runs, and tests natively in Windows VMs"

SWE-bench harness:

https://www.vals.ai/benchmarks/swebench — "running unit tests against the generated patch"

Copilot:

https://github.blog/changelog/2025-05-19-github-copilot-codi... — "makes changes, and even validates its work with your tests and linter"

https://docs.github.com/copilot/concepts/agents/coding-agent... — "how to build, test and validate its changes"

https://docs.github.com/copilot/how-tos/agents/copilot-codin... — "If Copilot is able to build, test and validate its changes"

https://github.blog/ai-and-ml/github-copilot/github-copilot-... — "coding agent can independently write, run, and test code"

Well - pretty much everyone knows it's lousy security, because you know, it's pretty obvious.

But maybe some people think it's not obvious, and point it out because they think they're clever?

I suppose that's possible.

Yes, exactly. This whole complaint boils down to "I don't want my changes to take effect when I make them because I don't expect that behavior."

Yes, I am aware that sandboxing technology exists. I use them. I don't expect them to be built into my LLM harness because I value modular software composition - and sandboxing should be provided by a product that specializes in that area.

OpenCode's allowlists are not there for security. They exist for LLM behavior guidance.

The fact that this mechanism is so primitive across all agentic clis is frankly a serious indictment of the competence & experience behind LLM-focused development teams.

Not at all. The proper solution to this problem is running in a sandbox - which is not reinvented by the LLM harness because there are already many great options.

You misunderstand the mechanism. It is not intended to provide security. It is intended to guide LLM behavior.

LLM harnesses build executables and run them. That is their primary purpose.

Changing an executable's signature by inserting a single extra printf() is well within that spec.

You did not hit max depth - you hit a timer designed to prevent rage posting.

My question stands - if you accept that LLM harnesses are designed to allow the building and testing of executables - how do you imagine you can prevent the building and running of executables?

Respectfully.

You are confusing CPU-level security with filesystem-level security.

I'm curious - how do you expect an LLM harness to build and test executables without being able to build and execute executables?

I don't know what you mean by "enforce W ^ X".

You can't give shell access and then revoke special parts of it. This is not controversial.

All your criticisms apply to all LLM harnesses - and everyone who genuinely cares about these things is using security on top of the harness, because OBVIOUSLY.

Your complaints are misguided.

And what would prevent the LLM from downloading and compiling its own version of git? But it names it "not-git".

I wonder how he imagines you can give shell access but securely prevent arbitrary command execution.

His complaint that "echo git | bash" still works is particularly nutty.

It globs your filesystem and re-reads AGENTS.md (injected in turn-0 system prompt) on every SSE turn. If you put a quick note in AGENTS.md to be read in the next session, you immediately force a full re-evaluation.

Um. Which then gets immediately cached again.

I prefer this behavior. I prefer my changes incorporated immediately, rather than wait for the next session. Call me crazy.

(Author is unhinged and this story is upvoted because #AI-HATE.)

WTF does the pandemic have to do with this?

I'm not sure, but if I may guess, I suspect he's talking about the fact that the entire US shut down for a year and people survived because the US Government printed money and gave it away free to businesses so they wouldn't collapse. (PPP loans.)

If we can do something like that for the pandemic, we can do something similar when push really comes to shove.

Oh yes, I agree entirely. I look at The Jetsons or Star Trek, and I see the fruits of technology shared by all of humankind.

But if the current trends continue, Elon will own all of the robots and the rest of us will be at his mercy.

How we change that - I don't know. But I do know we don't change it by putting our heads in the sand. AI is here and it is real. We MUST take it seriously. Shunning is not a viable option.

Well, sure. I'm not experiencing the same reality as you, either. I guess I assumed you were implying something more - a lesser experience or something. No?

I hope you understand you're proving my point. Ad hominem doesn't fly well around here.

I see a trend line from anti-AI back to anti-evolution to vitalism all the way to Galileo.

Humans have a deep need to be special magic flowers - and they can't stand it when science eventually shows them they're not.

Heh. I see you're being met with screeching and downvotes.

Not much to do about it, I guess, but continue to call it out.

While they’ll never have the same subjective experience as humans

You state this as a fact - are you aware the question is unresolved?

EDIT: I'd love to know why you're downvoting me for stating a known fact.

HEH. Don't know why you're getting downvoted. It's painfully obvious that there is a vicious AI backlash now, where every amazing advancement is met with denial and loathing.

Oh wait, sorry, I do know why you're getting downvoted. Fear.

You may be surprised to learn that the question of LLM consciousness is currently unresolved.

https://conscium.com/hubfs/Principles-for-Conscious-AI.pdf

Thank you for the validation. I only dabble in mathematics - so it's reassuring to hear what I remember - a clever proof is still considered a positive thing.

I do (of course) understand the issue that non-constructive proofs can be frustrating - and a constructive proof of the same theorem is valuable tool in seeing exactly why a truth is true.

But I guess I've never seen a non-constructive proof (in a space where no constructive proof is available) considered a failure.

While "I'm busy" might be true, "Ask Claude" is more helpful.

Maybe the people in your life are just trying to be helpful instead of effectively saying "Go away."

But hey, sure, it's AI so you should definitely hate on them. FUCK AI!!1!! AMIRIGHT?!?!