[hoppp]

How do you make sure you are not violating terms and conditions if they forbid injecting third party javascript into the website explicitly?

Does your LLM ingest terms and conditions too?

In some cases in the past, finding and using auth tokens in the front end has resulted in hacking charges, in those cases alleged hacker found an api key in the front end and directly accessed the database, which resulted in a jail sentance.

How do you solve this issue that some companies may become hostile if injected code extracts auth tokens and accesses backend?

[enos_feedler]

Many years ago I wrote a simple script to periodically pull my aeroplan miles from Air Canada using an extracted auth token. I was building my own mobile app to track all kinds of important numbers in my life. One day I woke up to my air canada account being nuked without access. I was on the phone for 3 days talking to many layers of support. At one point they were not going to re-enable my account and would lose 400k points. I was devastated. Thankfully i was able to get it back eventually. This whole era of using LLMs to manipulate services on the client is not going to end well. We need proper business-level support or its just an irresponsible hack you are letting loose into the wild.

[pancomplex]

We only do this with consent from the application owner - the use case is typically companies who don’t have an AI agent yet who want fast path to get one.

This is the process we usually do: https://frigade.com/how-it-works