Article isn't about agents. It's about the inference engine itself being exploited by a malicious LLM output before it is ever sent to your machine or harness.
replydeleted
replyIf we are treating ai agents like people, you could also just get the AI a laptop and apply the traditional tools to manage user laptops
replydeleted
replyI think if you are convinced you are sandboxing an LLM properly, you almost certainly are not. I think it is essentially impossible to have a frontier LLM with enough access to be useful without also giving it enough access to do damage if it's compromised or just goes off the rails.
replyIf you do not provide access to tools the LLM cannot do anything other than generate tokens. So really it is not about sandboxing a LLM but more about having control over what tools can be accessed and what they can do. Tools can be sandboxed depending on the sophistication of the tooling. A calculator tool for example is trivial to secure. Ensuring human approval allows for useful use cases and models trained to gate permissions work. A super intelligence with a weaker approval gate will be able to subvert. Inversely a super intelligent gate should be expected to prevent subversion by a weaker model.
replyAre you saying that LLM's will be able to exploit novel hypervisor bug with such ease that even a vm not running with any kind of network connection is a threat? I find this hard to believe. All the escape stuff I have seen has been around very poorly sandboxed agents.
replyAlso, operating systems should let us set filesystem permissions per app/process/executable instead of just user accounts.
replySimilar to how macOS/iOS Sandboxing works but at a more lower and granular level
SELinux is basically this.
replyhttps://www.canyonroad.ai/ does some of this in a way tailored to agents.
replypersonally I wish the OS would allow syscall filtering per user
reply[dead]
reply