That's a good idea. Be careful of the more advanced models finding ways to abuse/circumvent it though, even with only a limited set of parameters. Eg. A lot of git commands can be tricked into dropping into less which can drop into a full shell.

They know all the gtfobins.org tricks.

Doesn't even need to be completely air gapped, they can still allow it to talk to one specific endpoint to e.g. actually drive the model. As long as all commands are executed on a machine that can't reach the Internet, all is safe.

I don't actually doubt anything in the big post they sent out. I just doubt that running a LLM without the possibility of alignment drift is possible. It just doesn't seem like they work that way.

Just rm -rf /* does the trick.

sure. it can be safe on the host machine too, if you remove its ability to manipulate files outside of those you want it to. the reason it can run bash is because most people don't bother to change the very permissive defaults their harness comes with.

personally, I use Hermes, so the default is it asks permission for every single command it runs. if I didn't want that, I have a couple ways to to prevent the agent from removing files like this. I can do it with Python like so:

if "rm -rf" in command.lower():  
    return DENY  

or via regex like so:

\b(rm)\s+-rf\b, or \b(rm)\s+(-[A-Za-z]*r[A-Za-z]*f|-rf|-fr)\b to catch common variants. or you can just use a shell command filter to block all shell commands. you can also make a whitelist and add the commands that you want the agent to be able to run without oversight to that.

Even if your tools have been all verified with formal proofs you can still attack the hardware directly as a side channel.