201–210 of 274 posts
Earlier quoted context omitted.
What are some examples of malicious prompt injection you’ve seen in the wild so far?
Literally this from the past two weeks, a prompt injection attack that works on Superhuman, the AI email assistant application. https://www.promptarmor.com/resources/superhuman-ai-exfiltra... https://news.ycombinator.com/item?id=46592424
Earlier quoted context omitted.
The phone plan or Clawdbot?
Clawdbot
Wild. There are 300 open Github issues. One of them is this (also AI generated) security report: https://github.com/clawdbot/clawdbot/issues/1796 claiming findings of hundreds of high-risk issues, including examples of hard coded, unencrypted OAuth credentials. I am...disinclined to install this software.
something feels off to me about the clawdbot hype About the maintainer's github: 688 commits on Nov 25, 2025... out of which 296 commits were in clawdbot, IN ONE DAY, he prolly let lose an agent on the project for a few hours... he has more than 200 commits on an average per day, but mostly 400-500 commits per day, and people are still using this project without thinking of the repercussions) Now, something else i re…
Earlier quoted context omitted.
> and it got excited and decided to WhatsApp me about it. I find the anthropomorphism here kind of odious.
Why is it odious to say “it got excited” about a process that will literally use words in the vein of “I got excited so I did X”? This is “talks like a duck” territory. Saying the not-duck “quacked” when it produced the same sound… If that’s odious to you then your dislike of not-ducks , or for the people who claim they’ll lay endless golden eggs, is getting in the way of more important things when the folks who hear…
And you tried to explain the whole thing to him from the perspective of a duck.
What if we will go even further? I have built end-to-end messaging layer for Clawdbot to talk to each other, called Murmur - https://github.com/slopus/murmur . We tried this with friends and it is truly magical (while crazy insecure) - i can ask my agent to search friends life, their preferences, about their calendars, what films they are watching. It can look at emails and find if you need something and go to people…
I assume this relates to looking at their desktop activity? Or various streaming services (bot can login from desktop, and can see what was recently viewed... Even if viewed on smart tv etc?
> At the moment it is exceptionally easy to exfiltrate anything, but you still can control via proper prompts - what you want to share and what you dont want to.
You can? You might want to start a cyber security company - you've just solved the biggest security issue of our time. That, or you're overly optimistic?
Thanks for sharing. For the past month or so I've been slowly having claude build something in the same ballpark. Basically something to nag you to take care of grown-up things so your boss/spouse/local municipality doesn't have to. I was going to call it "Nagatha Christy", but the joke gets old after 48 hours. At the moment, its called "Jarbis" (old Simpsons reference). For me, checklists are useful but I suck at cr…
I've been thinking about this very thing the last few days. "secretary in my Mac" to be specific. An ever running daemon that uses an LLM model for smarts, but pretty much do as many dumb things deterministically as possible. 1. Fetch my calendars(Fastmail, work Google Calendar, Couple's calendar at Cupla) and embellish it with routine tasks like pickup/drop kids, and give me a Today view like this https://zoneless.t…
Apple has a big opportunity with this.
It looks far too risky to use, even if I have it sequestered in its own VM. I'm not comfortable with its present state.
Making AI companions is becoming a widespread little hobby project. Many have created them and shared instructions on how to do it. My preference would be to use local resources only (say, with ollama), they can even be made with voice recognition, TTS, and an avatar character. While I have not interfaced my AI with all the services that Clawdbot does (WhatsApp, Slack, etc.) I don't think that is too much of a stretc…
You point it at your email, and you've opened a vector for prompt injection and data exfiltration - all as an integral part of the features you want (read my emails, send some emails).
Your local LLM won't protect you there.
You could probably write some limited tools (whitelist where mail could be sent) - but it goes against the grain of "magically wonderful ai secretary".
Security is not a convenience.