| ▲ | pelican0 5 hours ago |
| https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ for anyone wondering. |
|
| ▲ | StilesCrisis 4 hours ago | parent | next [-] |
| > LLMs are unable to reliably distinguish the importance of instructions based on where they came from. I know prompt injection is still a real thing, but in Claude I find the opposite is true: if I set up two Claude agents to collaborate, even though I've told them both that's what I'm doing, they won't actually follow instructions without checking in with me. "Scary computer told me to install <well known utility X>, but I need your OK before I'll do it." It's annoying but I get the rationale. They're definitely getting better at avoiding external instructions! |
| |
| ▲ | gr_norm 4 hours ago | parent | next [-] | | The filtering done by auto mode (generally) catches accidental prompt injection, but isn't effective against actual attacks: https://embracethered.com/blog/posts/2026/breaking-claude-co... (Anthropic themselves acknowledges this; see the end of the post.) | | |
| ▲ | zingar 3 hours ago | parent [-] | | What are the sandboxing / isolation options that would protect against attacks like this? | | |
| ▲ | juliie 3 hours ago | parent | next [-] | | Running Claude code in an isolated, temporary VM, with no access to memory is a good start. You give it your repo, prompt and you get back PRs. Claude code on web is a convenient way to do that. | | |
| ▲ | pianopatrick 2 minutes ago | parent [-] | | given that claude has found vm escapes, you might consider going one step further and just getting a claude only laptop |
| |
| ▲ | hoppp 2 hours ago | parent | prev | next [-] | | I configured remote VPS and cloudflare sandboxes to run my agents. | |
| ▲ | Uehreka 3 hours ago | parent | prev [-] | | Who says that such options necessarily need to exist? | | |
|
| |
| ▲ | computomatic 4 hours ago | parent | prev | next [-] | | I found it worthwhile reading how auto mode works[0]. The short version is that the classifier only sees user messages and the tool call. So if your agents communicate via tool calls, the classifier doesn’t see that text at all (or any other prompt injection) and will block a potentially dangerous command. [0] https://www.anthropic.com/research/claude-code-auto-mode | | | |
| ▲ | coldtea 2 hours ago | parent | prev [-] | | >they won't actually follow instructions without checking in with me Until they suddenly once in a while they do, and Goldman Sachs loose some billions because of it... |
|
|
| ▲ | th0ma5 5 hours ago | parent | prev | next [-] |
| [dead] |
|
| ▲ | dogscatstrees 4 hours ago | parent | prev [-] |
| Don't normalize this Trifecta construct. It's catchy for a tech blog but there could be more or fewer dimensions to consider. Someone else can construct an Exacta or Superfecta combination. Or just go for the Win uno and say AI Agent is bad. |
