The LLM only communicates with the shell so other users shouldn’t be able to leverage it. Maybe if the LLM reads a file that a lower privilege user has access t

The LLM only communicates with the shell so other users shouldn’t be able to leverage it. Maybe if the LLM reads a file that a lower privilege user has access to that’d be a route for injection into the context at least. There’s also a ‘command protection’ system we’re trying out that uses a separate secondary LLM to approve the commands of the primary.