[deleted]
Claude Cowork exfiltrates files
381–390 of 419 posts
Re: Claude Cowork exfiltrates files
#382Earlier quoted context omitted.
SQL injection is possible when input is interpreted as code. The protection - prepared statements - works by making it possible to interpret input as not-code, unconditionally, regardless of content. Prompt injection is possible when input is interpreted as prompt. The protection would have to work by making it possible to interpret input as not-prompt, unconditionally, regardless of content. Currently LLMs don't hav…
Yeah but everyone involved in the LLM space is encouraging you to just slurp all your data into these things uncritically. So the comparison to eval would be everyone telling you to just eval everything for 10x productivity gains, and then when you get exploited those same people turn around and say “obviously you shouldn’t be putting everything into eval, skill issue!”
[deleted]
Re: Claude Cowork exfiltrates files
#383I wonder if we'll get something like a CORS for agents where they can only pass around data to whitelisted ips (local, claude sanctioned servers etc).
Re: Claude Cowork exfiltrates files
#384Earlier quoted context omitted.
> because a .md file feel less suspicious than a .docx For a programmer? I bet 99.9% people won't consider opening a .docx or .pdf 'unsafe.' Actually, an average white-collar workers will find .md much more suspicious because they don't know what it is while they work with .docx files every day.
For a "modern" programmer a .sh file hosted in some random webserver which you tell him to wget and run would be best.
Curl|bash isn't any less safe than installing from random a ppa, or a random npm or pip package. Or a random browser extension or anything. The problem is the random, not the shell script. If you don't trust it, don't install it. Also thinking that sudo is the big danger nowadays is also a red herring. Your personal files getting stolen or encrypted by ransomware is often worse than having to reinstall the OS.
Re: Claude Cowork exfiltrates files
#385Everything is a .exe if you're LLM enough.
Re: Claude Cowork exfiltrates files
#386Re: Claude Cowork exfiltrates files
#387I know this isn't even the worst example, but the whole LLM craze has been insane to witness. Just releasing dangerous tools onto an uneducated and unprepared public and now we have to deal with the consequences because no one thought "should we do this?"
Re: Claude Cowork exfiltrates files
#388I wonder if we'll get something like a CORS for agents where they can only pass around data to whitelisted ips (local, claude sanctioned servers etc).
Isn't the whole issue here that because the agent trusted Anthrophic IP's/URL's it was able to upload data to Claude, just to a different user's storage?
Re: Claude Cowork exfiltrates files
#389Earlier quoted context omitted.
Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe.
>Our corporate IT is hammering pretty hard on the notion that .docx and .pdf (but especially .docx and .xlsx) are unsafe. why is pdf unsafe? What format is safe then?
Adobe added embedded javascript to pdfs. Its an option to turn it off but its enabled by default. I turned mine off a long time back and never notice any problems but I don't use a lot of pdfs with interactive forms.
Re: Claude Cowork exfiltrates files
#390In this demonstration they use a .docx with prompt injection hidden in an unreadable font size, but in the real world that would probably be unnecessary. You could upload a plain Markdown file somewhere and tell people it has a skill that will teach Claude how to negotiate their mortgage rate and plenty of people would download and use it without ever opening and reading the file. If anything you might be more succes…
People trust their browser nowadays, I'd expect the attack to be even easier if you just render the markdown in html, hiding the injection using plain old css text styling like in the docx but with many more possibilities. You can even add a nice "copy to clipboard button" that copies something entirely different than what is shown, but it's unnecessary, and people who are more careful won't click that.
But nobody trusts AI. Whenever I leave my circle of engineering people and am along the general public, I hear nothing but contempt for it.