[wll]

How do we determine how vulnerable a system is without seeing how it is implemented? That is, can you generalize LLM usage to all apps and determine that the entire field is exposed?

Obviously it is a problem for end users, but that’s more of an optics and trust angle, just as browser extensions are a privacy nightmare.

I am as worried as you are on this front, given that people appear to be using browser extensions liberally, but that doesn’t mean all apps will be equally vulnerable. It is as implementation-dependent as it is dependent on the nature of today’s models.

I appreciate your writing on the topic, it is both a great overview and a reminder to staying engaged while looking for mitigations and best practices.

[wll]

Taking inspiration from existing automation tools could also be a good starting point beyond capabilities.

Shortcut for macOS and iOS has disabled-by-default advanced options Allow Running Scripts, Allow Sharing Large Amounts of Data, Allow Deleting without Confirmation, Allow Deleting Large Amounts of Data. [0]

[0] https://support.apple.com/guide/shortcuts-mac/adjust-privacy...