Will Cloudflare add malicious prompt injection as a service in addition to standard bot blocking?
This dropped earlier today: https://blog.cloudflare.com/zero-trust-mcp-server-portals/
Claude for Chrome
121–130 of 433 posts
Re: Claude for Chrome
#122Security is a problem to solve, not an unmoveable limiting factor.
Re: Claude for Chrome
#123Having played a LOT with browser use, playwright, and puppeteer (all via MCP integrations and pythonic test cases), it's incredibly clear how quickly Claude (in particular) loses the thread as it starts to interact with the browser. There's a TON of visual and contextual information that just vanishes as you begin to do anything particularly complex. In my experience, repeatedly forcing new context windows between sc…
Same. When I try to get it to do a simple loop (eg take screenshot, click next, repeat) it'll work for about five iterations (out of a hundred or so desired) then say, "All done, boss!" I'm hoping Anthropic's browser extension is able to do some of the same "tricks" that Claude Code uses to gloss over these kinds of limitations.
This has been exactly my experience using all the browser based tools I've tried.
ChatGPT's agents get the furthest but even then they only make it like 10 iterations or something.
Re: Claude for Chrome
#124Security is a problem to solve, not an unmoveable limiting factor.
Tbf, there haven't even been a single concept that would conceivably enable any kind of meaningful security to LLMs. So as of today, it really is an unmovable limiting factor.
There have been attempts to reduce the attack vector via tool use permissions and similar, and while that might've made it marginally more secure, that was only in the context of non-hostile injections. Because you're gonna let the LLM use some tools, and a smart person could likely figure out a way to use that to extract data
Re: Claude for Chrome
#125I think it's still early days it will get a lot better very soon
Re: Claude for Chrome
#126I built a very similar extension [1] a couple of months ago that supports a wide range of models, including Claude, and enables them to take control of a user's browser using tools for mouse and keyboard actions, observation, etc. It's a fun little project to look at to understand how this type of thing works.
It's clear to me that the tech just isn't there yet. The information density of a web page with standard representations (DOM, screenshot, etc) is an order of magnitude lower than that of, say, a document or piece of code, which is where LLMs shine. So we either need much better web page representations, or much more capable models, for this to work robustly. Having LLMs book flights by interacting with the DOM is sort of like having them code a web app using assembly. Dia, Comet, Browser Use, Gemini, etc are all attacking this and have big incentives to crack it, so we should expect decent progress here.
A funny observation was that some models have been clearly fine tuned for web browsing tasks, as they have memorized specific selectors (e.g. "the selector for the search input in google search is `.gLFyf`").
Re: Claude for Chrome
#127I don’t know if this will make anything better.
Internet is now filled with ai generated text, picture or videos. Like we havent had enough already, it is becaming more and more. We make ai agents to talk to each other.
Someone will make ai to generate a form, many other will use ai to fill that form. Even worst, some people will fill millions of forms in matter of second. What is left is the empty feeling of having a form. If ai generates, and fills, and uses it, what good do we have having a form?
Feel like things get meaningless when ai starts doing it. Would you still be watching youtube, if you knew it is fully ai generated, or would you still be reading hackernews, if you know there not a single human writing here?
Re: Claude for Chrome
#128TikTokification of the browser by AI is the killer feature, not writing an email. When on a page it automatically suggests the next site(s) to visit based on my history and the page I am on. And when I say killer, this kills google search by pivoting away from the urlbar and provides a new space to put ads. Spent years in the browser space, on Chrome, DDG, Blackberry and more developing browsers, prototype browser an…
StumbleUpon beat you to it by a couple decades, and most browsers already include some kind of sponsored recommendation feature (that people disable). Recommendation algorithms are essentially a solved problem, no LLMs required.
Re: Claude for Chrome
#129According to their own blog post, even after mitigations, the model still has an 11% attack success rate. There's still no way I would feel comfortable giving this access to my main browser. I'm glad they're sticking to a very limited rollout for now. (Sidenote, why is this page so broken? Almost everything is hidden.)
well, at least they are honest about it and don't try to hide it in any way.
They probably want to gather more real world data for training and validation, that's why this limited release.
openai have browser agent for some time already but I didn't hear about any security considerations. I bet they have the same issues
Re: Claude for Chrome
#130Earlier quoted context omitted.
With regards to llm injection, we sorta need the cat and mouse games to play out a bit, no? I have my concerns but I'm not ready to throw out the baby with the bathwater. You could never release an OS if "no zero days" was a requirement. Every piece of software we use has and will have its vulnerabilities (see Apple's recent RCE), we play the arms race and things look asymptotically fine. This seems to be the case in…
First of all, you absolutely cannot release an OS with a known zero day. IANAL but that feels a lot like negligence that creates liability. But even ignoring that, the gulf between zero days and plain-text LLM prompt injection is miles wide. Zero days require intensive research to find, and expertise to exploit. LLM prompt injections obviously exist a priori, and exploiting them requires only the ability to write.
> you absolutely cannot release an OS with a known zero day. IANAL but that feels a lot like negligence that creates liability.
You would think Microsoft, Apple, and Linux would have been sued like crazy by now over 0-days.