Hacker News Reader

You could contort the threat model such that prompt injection is something to worry about with a local model operating on local data and serving local results, sure.

View on HN

I think the "local results" assumption is not completely accurate. This line: "You tell Gemini in Chrome what you want to get done, and it acts on web pages on your behalf, while you focus on other things" implies that the local agent will perform in-browser actions, which in theory enables data exfiltration.

This iteration of Gemini doesn't perform in-browser actions, but they did announce they'll ship an agent later.

Yes. I agree that many of the announced and currently shipping features should be just fine from a security perspective with only a local agent.

Running an LLM locally makes no difference at all to the threat of malicious instructions that make it into the model causing unwanted actions or exfiltrating data.

If anything a local LLM is more likely to have those problems because it's not as capable at detecting malicious tricks as a larger model.

This is the MCP problem, essentially, and the solution is the same: the user should review and approve specific actions before they are taken.

Of course there will probably be a setting to auto-approve everything...

what if there's a prompt injection in some random web page that you visited?

Reply on news.ycombinator.com