I baked in lethal trifecta guards into my primary harness, DSCO, but it makes things much less smooth to run autonomously. Basically if you load secrets into a context, ideally it stops that and creates a process running a small local model that will write some code to not look at the secret and instead run code to operate on the secret without reading it in.

The risks are 1) exfiltration (network calls) 2) prompt injection (untrusted inputs) and 3) access to secrets

You can do some clever tricks like "spin up subagent without net access" to handle OCR of an internal document and have that agent communicate summaries to another "spun up subagent with net access" - imagine if one subagent is a local model and the other model is a frontier model over a web API. Maybe they still communicate in Neuralese or in abbreviated notes that you don't capture and are able to surreptitiously / covertly exfiltrate your information.

Ideally eventually you'll have some kind of dashboard that surfaces these risks as you're working.

Reports of AI researchers running massive swarms of 10,000 agents are definitely believable but the moment you start pulling in code libraries or other technology assets seems like you can get destroyed by a rogue actor. Definitely tons of unsolved problems here

Writing on mobile so this might poorly articulate the issue but it's interesting

▲

cedws 6 hours ago | parent | next [-]

What stops the agent from just writing code to actually read the secret? That’s kind of the core of the problem. The agent can be tricked into doing anything.

▲

solyin 5 hours ago | parent | next [-]

I don't know about GP's setup, but you give the AI an MCP that can do the thing without exposing the key to the AI directly. An all powerful agent could setup a fake endpoint and send itself requests and exfiltrate the key that way, so don't let it do that.

▲

arthurcolle 6 hours ago | parent | prev | next [-]

Indeed. But if it's a model running on your own hardware it isn't as risky. And the Anthropic models are actually pretty good at kind of writing code that will look at contents of a file without fully looking at the content, so it's insecure but not quite as bad as an open("secrets.txt").read()

	▲	cedws 5 hours ago \| parent \| next [-]
		Local model or not, all LLMs are susceptible to prompt injection and making mistakes (like those cases where you see the agent randomly deleted someone's home dir.) That's what Goldman are likely worried about. Not Anthropic going rogue or something. Concealing API keys is a relatively minor protection in the wider picture of the risks.
	▲	spockz 5 hours ago \| parent \| prev \| next [-]
		What does that mean? That it only reads part of it into context or RAM?
	▲	heartbreak an hour ago \| parent \| prev [-]
		What does using a local model have to do with it? I’m not worried about the secrets going to Bob, I’m worried about them going to Eve.

▲

tha_infra_guy 6 hours ago | parent | prev [-]

I wil encourage you to check https://runeward.io this is specifically the usecase we are building this for

▲

deadbabe 6 hours ago | parent | prev [-]

Uh why aren’t you using allowlists to prevent exfiltration to random domains?

	▲	arthurcolle 6 hours ago \| parent [-]
		I do this at the tool registry layer but this is a good idea for the agent sandbox itself