Hacker News new | ask | show | jobs
by __MatrixMan__ 443 days ago
I think that's stating it a big too strongly. You can just run the LLM as an unprivileged user and restrict their behavior like you would any other user.

There are still bad things that can happen, but I wouldn't characterize them as "this security is full of holes". Unless you're trusting the output of the explicitly untrusted process in which case you're the hole.
1 comments
wat10000 443 days ago
It doesn’t take much. Let’s say you want an assistant that can tell you about important emails and also take queries to search the web and tell you what it finds. Now you have a system where someone can send you an email and trick your assistant into sending them the contents of other emails.

Basically, an LLM can have the ability to access the web or it can have access to private information but it can’t have both and still be secure.

link
__MatrixMan__ 442 days ago
I'm not sure I'd characterize those two things as "it doesn't take much," that's quite a lot to give to an untrusted entity.
link
wat10000 442 days ago
My whole point is that you must consider this entity to be untrusted, which is pretty strongly at odds with having it act as an agent. It can’t both have access to private data and the outside world.
link
__MatrixMan__ 441 days ago
I guess it's just that I've given up on expecting them to be able to police themselves. Even if there was some fundamental change which made it plausible, it would likely be implemented by somebody I don't know or trust--so I'm going to be locking it down via OS-level controls anyway. And since I'm going to do that, doesn't the self-policing part then become redundant?

If it's not allowed to do something, I'd rather it just show me the error it got when it tried and leave it to me to tweak the containment or not. Having it refuse because it's not allowed according to its own internal logic just creates a whole separate set of less-common error messages that I'll have to search for, each of which is opaquely equivalent to one that we have decades of experience with. There is a battle-hardened interface for this sort of thing and reimplementing it internally to the LLM just isn't worth the squeeze.

I will confess that I've previously run untrusted agents (e.g. from CircleCI) as my own user without giving them due scrutiny. And shame on me for doing so. I just don't think that my negligence would be any greater had it contained an LLM.

link