> Partially, you could still deploy the AI in an isolated envirnoment. If there's nothing to access, there's no prompt injection.
If there's nothing to access, there's only limited value in using an LLM in the first place.
If your LLM is prevented from accessing anything other than the prompt, the only use is interactive use by the user; no automatic work done on any workflow items.
Honest question: couldn't this be solved by setting the authorization level of the agent the same as the user that prompted the question?
In this post's example, the agent would be limited by the author's scope inside the organization and, therefore, be incapable of exposing any unwanted file.
If you feed data to a LLM then there will always be a prompt injection. What you described is limiting the damage that the prompt injection can do, but also its usefulness.
You have a set of apis that user can access to do something, the llm uses those same apis. How is that limiting usefulness? By not invoking apis user is not allowed to?
Partially, you could still deploy the AI in an isolated envirnoment. If there's nothing to access, there's no prompt injection.
But who will have thought about something not being a SaaS but rather on-premises...
> Partially, you could still deploy the AI in an isolated envirnoment. If there's nothing to access, there's no prompt injection.
If there's nothing to access, there's only limited value in using an LLM in the first place.
If your LLM is prevented from accessing anything other than the prompt, the only use is interactive use by the user; no automatic work done on any workflow items.
Honest question: couldn't this be solved by setting the authorization level of the agent the same as the user that prompted the question?
In this post's example, the agent would be limited by the author's scope inside the organization and, therefore, be incapable of exposing any unwanted file.
1 reply →
If you feed data to a LLM then there will always be a prompt injection. What you described is limiting the damage that the prompt injection can do, but also its usefulness.
Why is it limiting the usefulness?
You have a set of apis that user can access to do something, the llm uses those same apis. How is that limiting usefulness? By not invoking apis user is not allowed to?
3 replies →