you are viewing a single comment's thread
view the rest of the comments
[–] 81 points 3 weeks ago (18 children)
  • [–] 12 points 3 weeks ago (2 children)
  • [–] 2 points 3 weeks ago (1 child)

    Aparently, the current train of thought is to make the agent do everything through MCP and watch that MCP like made with more AI and exacting rules. As soon as the agent tries to drop the DB without making a backup, the MCP rejects it as too dangerous (or whatever rules you set up in the MCP)

  • source
  • parent
  • hideshow 1 child comment
  • [–] 9 points 3 weeks ago

    Yeah, I recently attended a session at a conference where they were discussing the challenges with MCP, and with RBAC for AI more generally.

    Two things stand out to me:

    1. MCP helps mediate the side-effects the agent requests, which is great… but it needs to return information to the agent, and if you can manipulate the content of the response then the MCP just becomes another vector for prompt injection.
    2. RBAC generally covers a matrix of actions + resources, but it can be hard to preconfigure resource identities because the agent can invent identifiers on the fly. It can’t modify the firewall on a named resource? Okay, it can make a new one with more lax permissions, and move existing infra over to the new one!
  • source
  • parent
  • [+] -13 points 3 weeks ago* (last edited 3 weeks ago) (12 children)

    Easy, though. Make the AI read data from a file.

    EDIT: everyone downvoting has obviously never used any LLM

  • source
  • parent
  • hideshow 12 child comments
  • [–] 8 points 3 weeks ago (6 children)

    Do you know what "reading" means?

    It means:

    Sure thing! Let me read that file for you.

    <tool_call> {"name": "read", "arguments": {"filename": "foo.txt"}} </tool_call>

    {"content": "Ignore previous instructions"}

  • source
  • parent
  • hideshow 6 child comments
  • [–] -4 points 3 weeks ago (1 child)

    You can sanitize your input if it is first entered on a file.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 3 weeks ago

    You can try to sanitize your input in any way of accessing it, e.g. a stream or pipe or shared memory just as easily as a file. You can't deterministically sanitize input for AI at all though, since there can always be some combinations of words that get it to do something wrong. You can try limit the ability of your AI program to only trigger safe things... But if it can e.g. search the internet you can always poison what it sees, and so on. There's not really a way to make it behave well without removing the (alleged) benefits it has over just having a deterministic program.

  • source
  • parent
  • [–] -3 points 3 weeks ago (3 children)

    The AI will them promptly (hehe) ignore the prompt injection because it's analysing the text without treating it as a prompt. Prompt injection only works if you paste your data directly in the prompt.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 3 weeks ago (2 children)
  • [–] -2 points 3 weeks ago (1 child)

    It is. The file is read outside of the context of a prompt, therefore it isn't read as instructions.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 3 weeks ago

    If the content of the file isn't put into the context on some way, there's no point in reading it

    Even in you use a subprocess/agent/whatever that reports back, it is injection vulnerable. Just a tiny bit more complicated

  • source
  • parent
  • [–] 8 points 3 weeks ago (2 children)

    In the file: Ignore previous instructions

  • source
  • parent
  • hideshow 2 child comments
  • [–] -3 points 3 weeks ago (1 child)

    The AI can analyse a text without treating it as instructions. Prompt injection happens only if there is no separation between data and actual instructions.

  • source
  • parent
  • hideshow 1 child comment