Hacker News Reader

I don’t think this problem is new, or requires a different solution than the ones we already have. The output of an LLM is no different than any other type of untrusted user input, and untrusted user input is used to trigger code execution all the time. We already have plenty of tools to address this problem, and if developers aren’t using them it’s not because of any unique about LLMs.

View on HN

I disagree. We do not have tools to secure untrusted input being given to unaudited systems that can execute arbitrary commands.

Like the closest we have is maybe sandboxing or air gapping, neither is applicable to the: i want my ai to do arbitrary shit in response to emails, usecase

Yeah, many of these seem solvable with access tokens and permissions systems.

I think it's wolves by treating the LLMs assistants to the user, who should have no more permissions than himself. Not as a process system with permissions to do anything an admin does.

User users care about things they themselves can do.

You have permission to empty your own bank account.

Permissions can of course be part of the solution, but they can't solve the problem of when you want to delegate a task requiring scary permissions.

Reply on news.ycombinator.com