3 ms·
Code is not the only thing the agent could exfiltrate, what about API keys for instance? I agree sandboxing for security in depth is good, but it’s not sufficie
by jdkoeck 8mo ago
Code is not the only thing the agent could exfiltrate, what about API keys for instance? I agree sandboxing for security in depth is good, but it’s not sufficient and can lull you into a false sense of security.
- twodave 8mo agoThis is what emulators and separate accounts are for. Ideally you can use an emulator and never let the container know about an API key. At worst you can use a dedicated account/key for dev that is isolated from your prod account.
- gessha 8mo agoVM + dedicated key with quotas should get you 95% there if you want to experiment around. Waiting is also an option, so much of the workflow changes with months passing so you’re not missing much.
- twodave 8mo agoSure, though really these are guidelines for any kind of development, not just the agentic kind.
- pixl97 8mo agoHow much does a proxy with an allow list save a(n ai) person?