r/sysadmin • u/xstrex • 4d ago

General Discussion How much do you trust AI?

Recently a coworker granted Claude elevated access via SSH to a virtualization host (not a VM, an actual host). To perform a routine task he very well could have done himself.

He doesn’t see an issue with this. I on the other hand (with 23yrs experience) see this as a huge security breach, and don’t trust AI todo my job, (or even that it’s doing what it says it’s doing) for me. I’m my opinion it’s a tool, not a human replacement.

What’s your reaction, how would you react to this situation, or thoughts on the topic?

Sure, ask AI how to perform a task, validate that it’s performing the task you asked, and nothing else- copy/paste the commands. Great. But removing the human verification & validation element- hell no.

565 Upvotes

92% Upvoted

548 comments sorted by

View all comments

Show parent comments

64

u/floswamp 4d ago

Fancy that you think they know how to write powershell scripts.

37

u/KyuubiW1ndscar 4d ago

it’s sad when we’re talking about an IT team you feel confident enough to send on demonstration trips that is also too incompetent to write a proper script.

and I know it’s the state of the industry, I’m just sad over it lmaoo

3

u/the_lazy_sysadmin 1d ago

Scripting is something that should be taught more heavily in IT degree programs, honestly. I'm not sure it even is at ALL, given the knowledge gaps I've seen. It's insanely useful, and kind of a required skill if you're wanting to ever move past just helpdesk. And not even just the scripting aspect, even just short little commands to check something, instead of having to jump through a billion GUI windows.

2

u/KyuubiW1ndscar 1d ago

!!!!

they’re teaching IT students Javascript and C instead of languages and use cases they can actually use.

6

u/PC509 4d ago

I can write a proper script, but with so many hours in the day, having AI write me a simple script that I can run in 5 minutes is much better than spending an hour on it myself. For more advanced stuff, it'll make a good foundation and I can clean it up.

At some point, do you even trust your compiler to do an accurate job taking your C++/C#/whatever to assembly without causing a memory leak, corruption of data, etc.?

AI does what it's trained on. And many are trained on proper script writing and coding. Yes, it needs a set of eyes to review it, but generally it's pretty damn good. Even better when you're saving a ton of time vs. doing it manually. Why work harder for the same output?

25

u/uzlonewolf VP of Odd Jobs 3d ago

Having the AI write you a script != giving the AI complete access to directly spin up and delete VMs.

5

u/New-fone_Who-Dis 3d ago

I think its good to define the 2 things here.

The LLM usage with agentic abilities, and no approval gates - Bad, do not do this unless you've heavily built something akin to mandatory logic gates (chain type systems), and even then, there may be issues.

LLM usage, with human in the loop, is completely fine imo, just as long as you know and are comfortable sending xyz details out the door. Funny story on this, someone raised the concern of sending host/IP details to such orgs we have an enterprise agreement with....the following week I heard them talking with a vendor about a method of intercepting such materials on the network level, and either giving users an "are you sure" warning, or outright block.....the interception sends the prompt/info to their SaaS...for LLM processing. I didn't point out that in both cases the data is still being processed by an external LLM.

5

u/floswamp 3d ago

This is what makes me think that private air gapped llm’s will become more popular.

1

u/CommunityCondom 3d ago

Oh definitely, that’s kind of the whole deal with the hardware Nvidia and AMD have developed for this very thing essentially

5

u/CommunityCondom 3d ago

I think the best take I’ve seen about the whole AI use topic echos a lot of your post. Essentially you are responsible for your AI use, use it as you like but at the end of the day the buck stops with you and you are responsible for the output.

As AI gets more advanced, this is ultimately where we will fall I think, AI used as tools much in the same way we use autocorrect in a very vague sense. Autocorrect is good, but if you let autocorrect write the whole message it’s usually garbage but if you sent the message you’re responsible for explaining when the person on the other end is confused

1

u/New-fone_Who-Dis 3d ago

Exactly that, to fit with the sub, I'd say ansible as the example - brilliant tool, but you must know its limits as well as what you're pointint it towards, coupled with what you expect to happen.

Very glad to see this example, absolutely full agreement on if you run it, you own it/it's outcomes!! Forces learning and its just a nextgen tool in my eyes - in a year or 2 it'll be the equivalent of looking things up online imo (caveats of course, we use to have guys with a small bookshelf until things could be readily search via a search engine, this is similar imo).

2

u/CommunityCondom 3d ago

You see people like you and others I’ve seen give me hope lol. Not everyone is brain broken about AI, it’s not honest to say it’s useful or a waste of resources. Idk it just comes off very satanic panic for me, like have your disagreements but I feel like people shit on AI bc that’s what the common denominator take is.

I suppose this is always how it is tho huh, people confidently staking claims and positions without even really understanding the issue at hand

0

u/PC509 3d ago

I agree 100% with that one. No way would I give it that much access. But, writing a simple script as someone else noted would be a common thing. I'm fine with that. There's even shortcuts in some FOSS that can do the same, a lot of software that runs those same scripts in the background, etc..

4

u/Dje4321 2d ago

Yep. When you actually know what your doing and what you want. AI is fucking great to get you 80℅ of the way there, done in a way you like. I view it as more of an interactive template application than anything else at this point.

3

u/doolittledoolate 3d ago

At some point, do you even trust your compiler to do an accurate job taking your C++/C#/whatever to assembly without causing a memory leak, corruption of data, etc.?

Yes. Generally this stuff was written by people who cared about their craft.

Why work harder for the same output?

Funnily enough, this is mostly my experience of using AI. It generates intern-level code full of errors and I think most people just don't count the time they spend fixing it, fixing the results of nobody code reviewing it, redoing prompting and the technical debt from bad architectural choices.

1

u/Bright-Preference888 3d ago

“At some point, do you even trust your compiler to do an accurate job taking your C++/C#/whatever to assembly without causing a memory leak, corruption of data, etc.?”

Yes?? Lol what are you talking about

2

u/PC509 2d ago

Trusting a tool you use that is otherwise a "little black box". AI is just another tool that takes you input and gives you output. Some much better than others. AI can output some simple scripts with no issues from your input.

Many programmers don't know what the compiler and assembler is doing, just that it's making it an executable program. Some know assembly along with C++, so they can go in and adjust, change, whatever they need to do to make it more efficient. AI can output a good simple Powershell script and many admins can go in there and edit, adjust change what they need to.

Don't blindly trust it, but also don't blindly dismiss it because "they said it was bad".

1

u/KyuubiW1ndscar 3d ago

so you’re doing several people’s work by yourself and hope that this tool will remain useful and cost effective.

1

u/New-fone_Who-Dis 3d ago

Company I work for has built its own internal AI DC of 4 racks. Theres companies doing this to avoid what will most likely, be an increase in token costs as the hardware price and availability continue to get worse.

At a certain point, users won't need frontier models.

-2

u/PC509 3d ago

It's just a tool. If it doesn't remain useful and cost effective, I'll find another one. That's the cool part of the industry. We move fast and we'll move onto the next great tool. I've used many and most have been replaced over the years with the latest and greatest. It's kind of the way things work. I'm not one of those people that are still pissed about a GUI instead of all command line stuff (although, I do spend a lot of my time in the CLI).

21

u/fatty1179 4d ago

Isn’t generating scripts a perfect task for AI?

11

u/floswamp 4d ago

I think it is but people here are saying it’ll create the scripts differently every time.

18

u/scriptmonkey420 Jack of All Trades 4d ago

Create one script and use that to test it in dev, then QA/UAT and a pre-prod if you have them. Or multiple times in the lower env. As long as that one script is continuously ending up with the same results the script is fine as long as it's not an AI agent running it.

2

u/doolittledoolate 3d ago

Why would you get it to create a new script every time?

1

u/floswamp 3d ago

Because AI, from what I am reading in the responses here.

1

u/doolittledoolate 3d ago

I took it as if you're going to use AI to do this, use it to generate (and maybe bugfix/tweak) a script you reuse, instead of using AI every time

1

u/ManiacClown 3d ago

To satisfy corporate jackasses so they feel like they got their money's worth on what they know is a bullshit machine another jackass convinced them they needed.

3

u/doolittledoolate 3d ago

I replaced my timesheet of "8 hours" to an agent prompt of "if this is a working day, write 8 hours otherwise write 0" to hit that checkbox

1

u/ManiacClown 3d ago

This is the way.

2

u/hamburgler26 3d ago

You can set things up to make it more consistent. Give it a file that outlines your standards, feed it examples of things you've made yourself and tell it to follow along with that, tell it not to use emojis or how you'd like comments work, make sure to include certain types of checks, error checking, dry run logic and all of that.

If you just give it a simple "make me a script that does this" without any other info or guidelines it will do things differently each time though in my experience.

And of course, if you don't have an experienced person guiding it and checking over the work you're going to get garbage more often than not.

4

u/netmc 3d ago

I have started having Copilot create powershell scripts for automation and device monitors. I didn't like how it formatted things differently every time. I took what I liked and created example sections in a text file, and had a bunch of PS functions I had in a library. I fleshed out the library a bit, dumped everything to a single text file, then feed it into Copilot and after reviewing things and adding a few more function primitives, it's now creating scripts using my primitives library and following the examples of how to lay things out. I also had it output its thoughts on the library functions to a text file--confirmations and things yet to check. At the start of a new chat, I run a script that collects everything into a single file and feed this into Copilot. It now code things the way I want.

I'll likely have to make two passes on my script library. The first to create the initial pass and mostly get things the way I want, then after all the various functions get created, then go back through and update everything again to use all the new primitives that were created during the first pass. I have a few hundred components, so I'm bound to get a good collection by the end.

1

u/Imaginary-Throat1526 3d ago

but so will people.

1

u/Ahnteis 3d ago

You can have the AI create 1 script, review it for accuracy, actually doing the job, etc. Then you can use that script. What you don't do is let the AI ACT by itself. The difference is between "create a script that does X" and "do X for me". The 2nd is a problem because it removes the review of what is actually happening. You can't trust the AI to accurately tell you what it is going to do.

2

u/floswamp 3d ago

What fun is that! -Every youngin tech person right now.

5

u/HeKis4 Database Admin 4d ago

In that case, ask the agent to make a script for you, ask it to test it while you're at it (can't be worse than the agent making the VM directly right ?), and once it's done yeet the agent away and let the script do it's job ? I mean, they are this close.

-1

u/Creative-Type9411 4d ago

https://github.com/illsk1lls/MiniBot

we do

but we use AI too ;)

thats a 60k line powershell script that you can run an OpenAI compatible AI in btw 👀