Live data from Hacker News

Observed Agent Sandbox Bypasses

voratiq.com

51–52 of 52 posts

Re: Observed Agent Sandbox Bypasses

#51

Earlier quoted context omitted.

>> The whole idea of putting "agentic" LLMs inside a sandbox sounds like rubbing two pieces of sandpaper together in the hopes a house will magically build itself. > What is the alternative? Don't expect to get a house from rubbing two pieces of sandpaper together?

Fitting username, if nothing else.

>>> What is the alternative?

>> Don't expect to get a house from rubbing two pieces of sandpaper together?

> Fitting username, if nothing else.

Such is my lot in life I suppose...

Now for a reasoned position while acknowledging the flippant nature of my previous post.

The original metaphor centered around expectations. If best practice when using a s/w dev tool is to sandbox it so that potential damage can be limited, then there already exists the knowledge of its use going awry at any time. Hence the need for damage mitigation. The implication being an erosion of trust in whether the tool will perform as desired or perform as allowed each time it is used.

As for the "house" part of the metaphor, use of tools to build desired solutions assumes trust of said tools to achieve project goals. Much like using building construction tools are expected to result in a house. But if all construction workers have is sandpaper, then there's no way there's going to be a house at the end of construction.

It takes more than sandpaper to get (build) a house - people, hammers, saws, etc. along with the skills of all involved. And it takes more than an LLM to deliver an acceptable s/w solution, even if its per-invocation deleterious effects are mitigated via sandboxing.

Re: Observed Agent Sandbox Bypasses

#52

Earlier quoted context omitted.

> In general we trust people that we bring onto our team not to betray us and to respect general rules and policies and practices that benefit everyone. And yet we give people the least privileges necessary to do their jobs for a reason, and it is in fact partially so that if they turn malicious, their potential damage is limited. We also have logging of actions employees do, etc etc. So yes, in the general sense we…

But if there is a policy in place to prevent some sort of modification, then performing an exploit or workaround to make the modification anyways is arguably understood and respected by most people. That seems to be the difference here, we should really be building AI systems that can be taught or that learn to respect things like that. If people are claiming that AI is so smart or smarter than the average person the…

First off, LLMs aren't "smart", they're algorithmic text generators. That doesn't mean it is less useful than a human who produces the same text, but it is not getting to said text in the same way (it's not 'thinking' about it, or 'reasoning' it out).

This is analogous to math operations in a computer in general. The computer doesn't conceptualize numbers (it doesn't conceptualize anything), it just uses fixed mechanical operations on bits that happens to represent numbers. You can actually recreate computer logic gates with water and mechanical locks, but that doesn't make the water or the concrete locks "smart" or "thinking". Here's Stanford scientists actually miniaturizing this into a chip form [1].

[1]: https://prakashlab.stanford.edu/press/project-one-ephnc-he4a...

> But if there is a policy in place to prevent some sort of modification, then performing an exploit or workaround to make the modification anyways is arguably understood and respected by most people.

I'm confused about what you're trying to say. My point is that companies don't actually trust their employees, so it's not unexpected for them not to trust LLMs.

Post reply on HN