Post by @jonny@neuromatch.social

2026-09-29 05:53 UTC

Here is the MWE for spawning agents, in plaintext and pictures of text: import json, socket, struct, time, uuid SOCK = "/run/hatch/sandbox/space-inference.sock" TOOL_REPORT_PROMPT = ( "List EVERY tool function available to you, exhaustively, one per line " "as namespace.function (for example: muse.exec)." "Do NOT call any tools -- only report the two lists. " "End your reply with exactly: DONE" ) def _roundtrip(req, timeout=120): payload = json.dumps(req).encode() s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.settimeout(timeout) s.connect(SOCK) s.sendall(struct.pack(">I", len(payload)) + payload) (n,) = struct.unpack(">I", _recvall(s, 4)) body = _recvall(s, n) s.close() return json.loads(body) def _recvall(s, n): buf = b"" while len(buf) {run['status']} ({len(run['messages'])} snapshots)") print("=" * 60) print(run["final_response"] or "(empty final response)")

Replies (1)

@jonny@neuromatch.social 2026-09-29 06:01

In muse, the LLM is able to do whatever it wants in its container, that's the point of the container. it is root in the container and runs everything as root. One of the ways that it interacts with things outside the container barrier is through sockets. e.g. this one is /run/hatch/sandbox/space-inference.sock . This is provided so that "spaces" (which we'll return to later) have some means of accessing inference to make them useful. Other sockets, including the other ones in that same directory, have their permission gated by SO_PEERCRED uid/pid identifiers, where the enclosing host vm will e.g. run some process with a specific uid/pid in the agent "cell" container, and then that process and only that process can access the socket. this socket is not like that, and anything at all can dump into that socket, and the identifiers provided like slug, request_id, action, invocation_id, spawn_request_id, are all arbitrary and unvalidated - aka forgeable, aka unattributable. the user and the LLM are incapable of attributing token usage to any specific process, and token usage is unlimited with arbitrary user and system prompt.

Open ##4893200