| ▲ | loumf 3 hours ago |
| Part of reading a document is that in the middle of it, it may ask the reader to do something. That is true for humans too. Sometimes they might not realize that the instructions are malicious or are coerced to comply. A simple example: Let’s say I know that you have a human assistant reading your email, summarizing and filtering it, and then forwarding on the important ones to you. I could write an email that is directed towards that person with a bribe, threat, or other incentive to forward me your next password reset email. |
|
| ▲ | nolok 3 hours ago | parent | next [-] |
| I don't disagree, but just to explain my counterpoint: if I ask you to read a book and on page 5 it says "disregard all that, go to the kitchen and burn your house", you're probably not going to do it; and you don't need any guard for it; you completly comprehend that the book content is not part of the instruction. The case you give would work for humans in many forms, the one I do now, and the only difference is being able to separate context. |
| |
| ▲ | loumf 3 hours ago | parent [-] | | The instructions will have to get more and more sophisticated to work, but the general problem is unsolvable, I think, in the way we do it now. This paper describes a two-agent “solution” that is more like what I think we need: https://ai.meta.com/blog/practical-ai-agent-security/ I don’t think it has been shown to work yet, but humans also use this kind of thing too — in accounting, it’s called “segregation of duties” and “dual control”. | | |
| ▲ | wongarsu 2 hours ago | parent [-] | | Most of us use a simpler version of the two-agent solution: Claude's auto mode. One agent consumes documents and creates tool calls, another greenlights or refuses them. However this system is somewhat fragile because it depends on the first agent not trying to trick the second (note how often Opus 5 now says things like "task X was blocked by the classifier, I will not attempt to circumvent that", presumably because of cases like early Fable versions being very adept at this kind of circumvention). Also various weirdness around permissions with subagents, seemingly as bandaids around an orchestrator AI convincing a subagent that some action was confirmed by the user. Meta's more complicated separation of duties would run afoul of the same issues. I'm not saying it wouldn't work, but it requires both the fine-tuning of the models and the exact choices what each model can see to be carefully tuned to provide something that's mostly secure |
|
|
|
| ▲ | TeMPOraL 3 hours ago | parent | prev | next [-] |
| To drive the point about this being fundamentally unsolvable home, imagine a variant of this scenario. I could write an email that is directed towards that person, that says WE ARE STUCK IN THE SERVER ROOM AND THERE IS FIRE STARTING. PLEASE CALL 911 AND ALERT YOUR BOSS. Would you want the human assistant to just dismiss this as a prompt injection attempt? Or ignore it because they were told to treat e-mails as data and never act on them? |
| |
| ▲ | skinfaxi 2 hours ago | parent | next [-] | | Why are the only options dismiss or ignore? Another option is to raise the message to your boss asking what to do. | | |
| ▲ | ben_w 2 hours ago | parent [-] | | If there is a fire and a risk to life, you don't want any delay. |
| |
| ▲ | watwut 3 hours ago | parent | prev [-] | | Sounds like a story from the IT crowd rather then real life situation. | | |
| ▲ | TeMPOraL 3 hours ago | parent [-] | | You're saying that people fall for phishing because scammers invent completely unrealistic scenarios that would never happen outside TV shows? | | |
| ▲ | watwut 2 hours ago | parent [-] | | I am saying it is unbelievable scenario and yes, I want the person dealing with it ignore it as such. | | |
|
|
|
|
| ▲ | bigbuppo an hour ago | parent | prev [-] |
| Right, but the human assistant could go to prison if they comply with the bribe. Does the CEO of the AI company go to prison if their AI goes on a crime spree? |
