[charrondev]

Honestly the it seems like they play for wiring up an LLM to something can actually take action is to only give the LLM the same access that the same user querying your API would have.

I’ve been exploring an LLM -> API layer for our app and I’m not worried about prompt Injection because if the user was actually malicious they could just used the interface or the API to do the same thing.

In other words if you treat the LLM like any other frontend then you really should have a problem from a security standpoint. Your would have your iOS application super user access your system, why would you treat an LLM different than any other client.

[simonw]

If you're completely confident that there's no way an attacker might get their text into your user's LLM session then yeah, you have nothing to worry about.

Potential vectors to consider:

- Your app lets users run it against text from other sources - fetched web pages, incoming messages - server logs - which an attacker might be able to influence

- Your users can copy and paste text into your app - and an attacker might be able to trick them into eg copying in a dozen paragraphs of text without first reading it to check for weird hidden prompt instructions

[ljlolel]

Same as CSRF protections and MacOS random binary from internet running protections.