[lbeurerkellner]

I agree, one of the issues are tokens with too broad permission sets. However, at the same time, people want general agents which do not have to be unlocked on a repository-by-repository basis. That's why they give them tokens with those access permissions, trusting the LLM blindly.

Your caution is wise, however, in my experience, large parts of the eco-system do not follow such practices. The report is an educational resource, raising awareness that indeed, LLMs can be hijacked to do anything if they have the tokens, and access to untrusted data.

The solution: To dynamically restrict what your agent can and cannot do with that token. That's precisely the approach we've been working on for a while now [1].

[1] https://explorer.invariantlabs.ai/docs/guardrails/

[ljm]

If you look at Github's fine-grained token permissions then I can totally imagine someone looking at the 20-30 separate scopes and thinking "fuck this" while they back out and make a non-expiring classic token with access to everything.

It's one of those things where a token creation wizard would come in really handy.

[sam-cop-vimes]

This has happened to me. Can't find the exact combination of scopes required for the job to be done so you end up with the "f this" scenario you mentioned. And it is a constant source of background worry.

[ahmeni]

Don't forget the also fun classic "what you want to do is not possible with scoped tokens so enjoy your PAT". I think we're now at year 3 of PATs being technically deprecated but still absolutely required in some use cases.

[arccy]

github's fine grained scopes aren't even that good, you still have to grant super broad permissions to do specific things, especially when it comes to orgs

[robertlagrant]

I agree, but that is the permissions boundary, not the LLM. Saying "ooh it's hard so things are fuzzy" just perpetuates the idea that you can create all-powerful API keys.

[weego]

I've definitely done this, but it's in a class of "the problem is between the keyboard and chair" 'exploits' that shouldn't be pinned on a particular tech or company.

[ljm]

It's the same as Apple telling people they're holding their iPhone wrong, though. Do you want to train millions of people to understand your new permissions setup, or do you want to make it as easy as possible to create tokens with minimal permissions by default?

People will take the path of least resistance when it comes to UX so at some point the company has to take accountability for its own design.

Cloudflare are on the right track with their permissions UX simply by offering templates for common use-cases.

[gpvos]

No, Github is squarely to blame; the permission system is too detailed for most people to use, and there is no good explanation of what each permission means in practice.

[idontwantthis]

We all want to not have to code permissions properly, but we live in a society.

[flakeoil]

How about using LLMs to help us configure the access permissions and guardrails? /s

I think I have to go full offline soon.

[TeMPOraL]

Problem is, the mental model of what user wants to do almost never aligns with whatever security model the vendor actually implemented. Broadly-scoped access at least makes it easy on the user; anything I'd like to do will fit as a superset of "read all" or "read/write all".

The fine-grained access forces people to solve a tough riddle, that may actually not have a solution. E.g. I don't believe there's a token configuration in GitHub that corresponds to "I want to allow pushing to and pulling from my repos, but only my repos, and not those of any of the organizations I want to; in fact, I want to be sure you can't even enumerate those organizations by that token". If there is one, I'd be happy to learn - I can't figure out how to make it out of checkboxes GitHub gives me, and honestly, when I need to mint a token, solving riddles like this is the last thing I need.

Getting LLMs to translate what user wants to do into correct configuration might be the simplest solution that's fully general.

[spacebanana7]

This is interesting to expanding upon.

Conceivably, prompt injection could be leveraged to make LLMs give bad advice. Almost like social engineering.