| ▲ | andai 2 hours ago | |||||||||||||||||||
Yeah, that's the core of the issue: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ The "lethal trifecta": To be useful, an agent needs internet access, untrusted inputs, and your private information. So it can get prompt injected and exfiltrate your data. (Indeed I read that Claude Code puts your email address into HTTP requests it makes to random servers?) My solution here was to just not give it anything, but that does preclude the "my claw bought a car!" result everyone's excited about. My way of thinking here is "blast radius". Assume it will get prompt injected. What goes wrong? Then design the setup so that scenario is not bad. e.g. it has my keys but they've got $5 of credit on them. It has access to the filesystem, but only on its own Linux account. (Ok I set this up last year before they could communicate thru the bloody CPU cache, might need an update :) | ||||||||||||||||||||
| ▲ | simonw 39 minutes ago | parent | next [-] | |||||||||||||||||||
I've recently talked to people at Anthropic who are very confident that they have effectively solved the prompt injection risks that cause lethal trifecta attacks with their latest models. The open challenge is how to prove it! | ||||||||||||||||||||
| ||||||||||||||||||||
| ▲ | pkaye an hour ago | parent | prev | next [-] | |||||||||||||||||||
From what I've read Claude Duet will not purchase anything without manual approval. | ||||||||||||||||||||
| ||||||||||||||||||||
| ▲ | ryoshu an hour ago | parent | prev [-] | |||||||||||||||||||
Don’t use LLMs to enforce invariants. | ||||||||||||||||||||