Needs to be deterministic. ACLs
CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
21–30 of 70 posts
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#22It's all fine until OpenClaw decides to start prompt injecting the judge
Calling it now. Show HN: Pincer - A small highly optimized local model to detect prompt injection attempts against other models.
Sounds like a good idea. Please send me the Github link once done and I'll have my OpenClaw take a look and form my opinion of it.
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#23Earlier quoted context omitted.
> We’re supposed to be fixing LLM security by adding a non-LLM layer to it, If people said "we build a ML-based classifier into our proxy to block dangerous requests" would it be better? Why does the fact the classifier is a LLM make it somehow worse?
The fact that LLMs are "smarter" is also their weakness. An oldschool classifier is far from foolproof, but you won't get past it by telling it about your grandma's bedtime story routine.
Fairly hard to bypass the latest LLMs with grandma's bedtime story these days, to be fair.
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#24Earlier quoted context omitted.
The fact that LLMs are "smarter" is also their weakness. An oldschool classifier is far from foolproof, but you won't get past it by telling it about your grandma's bedtime story routine.
Fairly hard to bypass the latest LLMs with grandma's bedtime story these days, to be fair.
That specific trick yes, but the general concept still applies.
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#25Needs to be deterministic. ACLs
Yes, full stop. They say they cap the body to 16k and give the LLM a warning, lol. And this is coming from a credit card company.
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#26Comments like this don't fill me with confidence: https://github.com/brexhq/CrabTrap/blob/4fbbda9ca00055c1554a...
// The policy is embedded as a JSON-escaped value inside a structured JSON object.
// This prevents prompt injection via policy content — any special characters,
// delimiters, or instruction-like text in the policy are safely escaped by
// json.Marshal rather than concatenated as raw text.Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#27Earlier quoted context omitted.
Fairly hard to bypass the latest LLMs with grandma's bedtime story these days, to be fair.
That specific trick yes, but the general concept still applies.
It does, but it's certainly not trivial. In fact there's an unclaimed $1000 bounty on prompt injecting OpenClaw: https://hackmyclaw.com/
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#28[flagged]
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#29[dead]
Re: CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production
#30The debate here is missing a practical question: is the judge from the same model family as the agent it's judging?
If both are Claude, you have shared-vulnerability risk. Prompt-injection patterns that work against one often work against the other. Basic defense in depth says they should at least be different providers, ideally different architectures.
Secondary issue: the judge only sees what's in the HTTP body. Someone who can shape the request (via agent input) can shape the judge's context window too. That's a different failure mode than "judge gets tricked by clever prompting." It's "judge is starved of the signals it would need to spot the trick."