61–70 of 228 posts
Earlier quoted context omitted.
Since you cannot fix information leakage from LLMs, you must remove the information so that it cannot be leaked. There is no contradiction there.
Right, that's the fix. So saying that it's not fixable is incorrect.
“Prompt injection attacks have become, to agentic AI, what SQL injections were to web applications: a systematic, category-wide vulnerability class that requires the same systematic strategies and defenses.” ??? Isn’t prompt injection far more fatal to LLMs than SQL injection is to SQL databases? Like, the problem of SQL injection was that user input was forming part of the instruction string given to the SQL engine,…
Earlier quoted context omitted.
What do you mean by "was" and "fixed it" ? It is still very much an issue and remains in the OWASP Top 10. https://owasp.org/Top10/2025/A05_2025-Injection/
sqli is easily and fully mitigated and has generally been a non-issue for any half-serious project, especially if you use any kind of SAST. Your link actually subsumes any type of injection, not just sqli. Some of them are marginally harder to fix than sqli, most aren't. In contrast, we don't know how to solve prompt injection.
Earlier quoted context omitted.
Exactly. SQL injection was caused by treating user input as part of the instruction instead of as the pure data that it was intended as. Separating those two fixed it. Prompt injection is unavoidable because the user input is intended as instruction.
What do you mean by "was" and "fixed it" ? It is still very much an issue and remains in the OWASP Top 10. https://owasp.org/Top10/2025/A05_2025-Injection/
It's about how easily it's mitigated completely. Use a proper db library which does escaping and it's completely eliminated.
Earlier quoted context omitted.
"How is this a Github vulnerability? The researchers are the ones that grant the agent access to private repos and then ask it to answer questions in public repos.. of course this allows extracting private information?" I think the assumption is that the permissions are scoped to the repository you're currently asking questions on, rather than your private repositories as well. I can see arguments for both sides.
But they explicitly setup the permissions this way.
I stopped disabling plugins from "managers" that overreached from their repos only to org wide years ago. While I liked a lot of people I worked with in that institution on a personal level, I was happy not having to work with them as devs, when that institution got closed.
Some nice people behave rather dumb when it comes to tech. And than comes AI and tramples along, because there are no boundaries (See the article what they are writing about /assumed/ security boundaries. They assume things so much, it becomes physical pain to read or listen to them.)