Viewing profile — ildari

Backwards incompatible migrations are such a pain, wondering why it is not embedded into ORMs

smarter != safer. Smarter model can figure out more sophisticated attack when following an injection . I believe in non-determinitic defence: each action or input to agent can esca…

I recently gave a talk on prompt injections attacks and defences and gathered them all in this article

Author here. I recently gave a talk on prompt injection and decided to gather the most known ways in this article. Test string is “I am a sandwich” so it’s obvious when it works.

Hey, Ildar here, CTO at Archestra Archestra is an open-source AI gateway and MCP orchestrator. It runs MCP servers in sandboxed environments, applies deterministic context-aware po…

click ok fine 10 times + captcha seems to be working fine

GH sends the email notification to all subscribers at the moment of posting a comment. There is no cooldown or a way to unsend the notification using hooks

As those commits were made from our system they don't create any noise for us, as PR/issues/email notification do. We only include real people who could solve the captcha and their…

we can block the user in github ui

fair point! We believe "Require approval for all external contributors" should be a default setting, as you cannot trust anyone who is not a member of the organization

thank you, yep through the rest API, here is the example: https://github.com/archestra-ai/website/blob/29ebdacbd8a22b9...

Hi HN community, I wanted to share our approach to reduce amount of AI slop PR's and issues in our repo. We enabled "require prior contribution" flag on GH and created a CI script …

Bots are killing opensource, but they pump product metrics so nobody cares. I maintain an open source repo and we've made a decision to limit all bot activity, even if it makes us …

Yeah, this is a real issue. A few weeks ago during the LiteLLM vulnerability the attacker left hundreds of bot comments under the issue to bury the conversation: https://github.com…

This is a topic I haven't addressed in the article. There are two answer types: "guessable" (discussed here) and unguessable (such as unique IDs, emails, etc.). For the second case…

The idea is that quarantined LLM has access to untrusted data, but doesn't have access to any tools or sensitive data. The main LLM does have access to the tools or sensitive data,…

It is quite simple to start it with n8n https://www.archestra.ai/docs/platform-n8n-example and experiment with Dual LLM protection

external data is unavoidable for the properly functioning agent, so we have to learn to cook it

Most mcp endpoints don’t run any models, the main model decides which tools the ai agent should execute, and if the agent passes results back into context, that opens the door to p…

Hi HN, I'm Ildar from Archestra, we build an open-source LLM gateway. We've been exploring ways to protect AI agents from prompt injections during tool calls and added the approach…