Show HN: Geiger – See every AI agent on your machine and what it can touch

I think there is a cycle, like with most things of this nature.

You start really locked down, and you read and approve every request for access. You do this for a while, but never see a result you deny, so you stop reading as closely. You keep hitting that approve button. You start paying even less attention to it. You start feeling silly, like you are simply slowing the process down. You get frustrated, because you keep coming back to your session and realizing your agent has been stuck waiting for approval for a long time, and the task that would have been done by now hasn’t even started.

Now you are running even more simultaneous sessions, which means more and more of your agents are stuck waiting for your approval. You feel even sillier, because you are taking even less time now to review and approve requests, but your review step is causing more and more slowdowns because you have more sessions going so you take longer between approvals. You feel like you are spending most of your time cycling through sessions hitting approve. You still have not come across a request that was dangerous or would have caused an issue, so you feel more and more like you are wasting your time.

So you slowly start to give your agents more access with fewer review steps.

Maybe this results in a catastrophic failure at some point, or maybe it doesn’t.

AFAIK, I know plenty of frontend engineers that without blinking run "npm install" on random 3rd party projects they find on GitHub, and they do their banking and everything else on the same machine. But then again, I also know people (one person to be fair) who have unprotected sex with prostitutes, so maybe something makes me slightly biased here.

I mean yeah, there are a ton of people who are stupid enough to disregard all kind of safety precautions. That doesn't mean the safety precautions are invalid though.

I don't think you're just lucky, depends heavily on the model + reasoning effort. I've never had any of the GPT models do anything of the sorts when using the higher reasoning efforts, but sometimes when I play around with local models, even "big" ones (as big as you can fit with 96GB VRAM) sometimes forgets/misses to define $ID then do "rm -rf data/$ID" for example, deleting more than they intended.

I’ve been looking along a similar line, but I came at it from the infra side rather than the software.

Mine pretends to be a local ACP agent, but it’s actually managing a Docker container and proxying the ACP connection into the container over websocket. You can specify a bunch of utility stuff in the YAML definition like directories to bind-mount, directories to copy from the host, scripts to run when the container starts, etc. You can also toggle whether ACP-native tools like read/write file and shells execute on your host or in the container (in container by default).

Works well, I forget whether I’m on that or pi-ACP directly until it spits out a time in the wrong timezone or I forget that it can’t check my DNS settings or something.

Really cuts down on the damage it can do. Mine is basically down to “it can delete my ~/.pi and the repo it’s working on” and that’s about it unless it can escape the container.

https://github.com/SethCurry/abyss