But then it decides to exfiltrate all your shit even inside the container. Which is something I'm trying to lock down at work atm.

Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.

I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.

▲

marcosscriven 40 minutes ago | parent | next [-]

Been thinking about this a lot lately, and it’s a surprisingly difficult problem.

All it needs is public access to anything it can have the tiniest effect on, and it can exfiltrate data. Something as simple as a read count on some obscure forum post would be enough, albeit very slow.

▲

fennecbutt 20 minutes ago | parent | next [-]

Yeah, exactly. I'd say it borders on almost unsolvable for any agent of reasonable complexity.

You see some of the vulnerability chains humans come up with and they're just insane.

Even scanning network data for sensitive strings (say matching against a codebase or data set it works on) is tough because you can only check so granularly before you get loads of false positives.

But maybe like a "rolling" sort of check would help with that, % of outbound data matching private dataset (which should be operated on but not transmitted) over time. That way it minimises what gets out while dealing with false positives. Some biz thresholds might be >20% of data others might be >0.5%. Hmm.

▲

smashed 21 minutes ago | parent | prev | next [-]

I am tackling this using the Lethal Trifecta principle.

The idea is that agents never have all parts of the trifecta, maximum 2: untrusted content, private data or network access.

Harness have network access by default since they are driven by their provider API, unless you use offline models. So that's a problem.

I am then passing around messages that are tagged trusted/untrusted and the engine can monitor if any agent in the project ever completes the Lethal Trifecta and thus, is vulnerable.

Usually this means for most workflows, the "work" gets done by an offline LLM after some input/classification stages. There's not many ways around it.

Yes, it's a difficult problem.

	▲	fennecbutt 17 minutes ago \| parent [-]
		That's a great way to do it. In terms of agent architecture I'm initially trying to minimise specialisation to make deployment easier on us. Infrastructure is becoming our largest blocker because it's otherwise so quick to get an agent up and running. With your trifecta, let's say the three musketeers, how do you prevent sensitive data holding A from passing said data to B or C if they all need to collaborate to get a task done?

▲

epolanski 15 minutes ago | parent | prev [-]

If you can make any request to the outside world you can exfiltrate data, period. You can even include data in the uri or headers and they will appear in logs.

That obviously includes talking with the provider.

If you want it secure, it has to be off the internet and on your own hardware.

▲

kleogeos an hour ago | parent | prev [-]

[flagged]