4 ms·
It's funny that as the most popular programming languages FINALLY got smart injection-safe SQL strings (js template literals etc), we're right back to square on
by jitl 3mo ago
It's funny that as the most popular programming languages FINALLY got smart injection-safe SQL strings (js template literals etc), we're right back to square one with AI over the top that can't tell the difference between trusted and untrusted content. Funny and sad.
- hedbdbf 3mo agoA year ago, I made a big stink with the security people at my company about how we were going to get fucked due to prompt injection because we did not have a robust model for isolating contexts with untrusted information from agents who are empowered to take action. I was right, and that was good to do, but the reality is the modern models are very good at resisting prompt injection. The types of broad exploits we expected to see never materialized because the models improved faster than expected. It can still happen, there are ways to manipulate them and it’s still vital to have a good security boundary, but generally when I see someone really worried about prompt injection I take it to the sign that they have not been paying attention