Comment by simonw
11 hours ago
> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
11 hours ago
> Malicious instructions hidden in an externally shared document could make Copilot alter drafted or edited documents in Word and propagate the attack to new documents.
Oh no.
Mixing instructions and data is never a good idea.
And I thought people understood that.
Security minded programmers understand that. "People" as a whole have not even heard about mixing instructions and data, and certainly not the reasons why it is not a good idea.
And AI chatbots are very much targeted at the second group, not the first.
> "People" as a whole have not even heard about mixing instructions and data, and certainly not the reasons why it is not a good idea.
Because it's not a concept in the real world. Physical reality has no such separation, and neither do human minds.
Tell people you're discussing a board game or some sport, then they'll understand - other than bureaucracy (scary!) and school (traumatic!), that's the one kind of artificial system with rules affording for code/data separation that general population has most experience dealing with.
1 reply →
Even engineers like doing it sometimes. The old telephone system was so hackable because of in band signaling.
11 replies →
> And AI chatbots are very much targeted at the second group, not the first.
I suppose this is why the AI labs are famously not releasing developer-oriented tools.
3 replies →
When working on PDFKit for MacOS, one short-coming our implementation had was the lack of support for Javascript in PDF's.
Oops.
(I mean, I'm one engineer and I was not going to try and hoist a JS runtime in my little PDFKit framework. And besides, the sample PDF's we were running into with JS were rare—usually tax-like forms that would add numbers from A and B and display the result in C. It seemed like a huge effort for such a small gain . Oh, and a security vulnerability.)
Arguably the biggest vuln of the filetype.
People understand that. They just don't know how to implement that with LLMs
In the GPT-2 era LLMs were just data. Instructions did not exist, and if you added them to your data they would not be followed. Then around 2022 we figured out how to patch in instruction following with a bit of fine tuning, leading to the current AI bubble. That's an ugly hack that leads to all these issues. But it's what this entire AI bubble is founded on. And nobody seems to have found a better way (or at least one that actually scales and doesn't make unreasonable sacrifices)
Sure they would be. But for those old models, you'd have to prompt it in a framing of a screenplay or something.
You're forgetting that LLMs just output a stream of tokens - the interpreter that acts on those is a piece of classical code, and sits outside of the model.
2 replies →
Separation of instructions and data is artificial. Reality has no such separation. A general purpose system needs not to have them either; it's a design feature, not a bug.
People get too hung up on this fundamentally wrong idea, and the space of security, instead of progressing, is just running in circles like a headless chicken, making a mess of everything.
Literally all of software is artificial? Being explicit and reasoned about how you choose to allow or deny a particular computation is, surely, at the heart of a lot of computer security?
3 replies →
With that logic you could call SQL injections a natural feature of database management systems. If a general purpose system starts dropping tables or messing up numbers in a report just because that string was in the text it read, that system isnt worth a damn in the enterprise sector
18 replies →
> Separation of instructions and data is artificial. Reality has no such separation. A general purpose system needs not to have them either; it's a design feature, not a bug.
Note: I'm parsing 'needs not to have them' as 'needs (not to have them)'. If you were using 'needs not' as an alternate for 'does not need' then never mind, although I'd guess that is not the case because the alternative for 'does not need' would be 'need not' rather than 'needs not' and you probably wouldn't make that mistake.
Doesn't this imply that it is not possible to implement a general purpose system on any of our current computing devices?
For all our current computing devices everything that can be done on devices that do not separate instructions and data can also be done on devices that do, and vice versa.
1 reply →
A pure Harvard architecture machine has exactly that separation. Admittedly, there needs to be some mechanism for converting data to code so you can actually program it, but it doesn't have to be accessible by the device itself. E.g. programming the Microchip PIC16 series of microcontollers required driving the reset pin to 13V (enough to destroy any other pin). It's not possible without dedicated external hardware.
3 replies →
Only in systems that need to be themselves super generalist. Which is almost never the case.
3 replies →
If you hand me two sheets of paper, one of them containing instructions and another containing data, I'll have a pretty easy time keeping them separate, and I think most humans wouldn't struggle with that problem either.
3 replies →
There are so many better alternatives but it seems many people really like Word for some weird reason. The last time I cared I had to look up how to make a document starting the page numbering on the 2nd page. It turns out there are totally different ways between different versions of Word. shrug.jpg
Such as? Word hits the sweet spot of having support for all the complexity the average person may encounter/want to create.
Libre, Apple Pages, and Google Docs all seem like clearly worse tools in most aspects in my experience.
LaTeX is extremely powerful, but also way too complicated for the average non-HN person/person who doesn't live in complicated documents.
1 reply →
What are the "so many better alternatives"? Google Docs is pretty decent but a fair bit more basic. Proper technical authoring systems like Typst, LyX and LaTeX are way too hard for the average person. LibreOffice is much worse than MS Word.
Code is data is symbolic reality. I don’t think people’s understanding changes this.
And I thought people understood that.
The graybeards know it. But they only know it through experience. It's blue/red/pink box phone phreaking all over again.
The technology changes, but the mistakes remain the same.
‘(Lisp would like a word)
People who use machines based on the von Neumann architecture?
Tell that to middle bosses and CEOs and MS Office VBA bootlickers and Excel workshippers.
Meanwhile, CSV files parsed with custom reviewed AWK scripts can be 100% safe with charts made from Gnuplot. Heck, even some notebook like Ipython with a CSV module would be far more desirable than a spreadsheet. Any of them. Just look at the Genomics Disaster on Excel because of shitty parsing.
Isn't React, the most popular JS library, an example of that? Clearly people don't understand that
No it’s not an example of that. Do you store components in your component state?
2 replies →
something something lethal trifecta
waiting for W^X reinvented, renamed and marketed for the Agentic Era (r)TM
Self-replicating Inference Guardails Hardening or SIGH
[flagged]
Are you just going to hop around every thread on this article and be snarky?
1 reply →
Indeed - but some models are more robust than others. I tried to make Opus-5 execute hidden instructions embedded a picture using steganography. It's very hard to find a reliable payload.
I was thinking the next generation of attacks will involve playing the system prompt & harness the same way return-oriented programming does with normal binary code. That is, setting things up so that the system prompt itself implies the agent should do what the attacker wants them.
But that's probably off the table now that Anthropic is spreading the gospel of instruction minimization (which I assume but haven't checked applies to their own system prompt as well).
Source of this realization? Claude Code on the Web consistently tells me it wrote me some code on a branch but did not open a PR because I told it not to open PRs. Thing is, I never told it any such thing. There's some setting somewhere that's flipped, that activates a bit of its system prompt, and makes the agent not do what I asked it to do and claim I told it not to do it.
(It's probably trivial to find the offending switch, but I've been too lazy to do it yet.)
Breaking just now:
- Erroneous information left in plain sight in an externally shared document could make Copilot - or any other agentic system, including LLMs and protein-based intelligence, alter drafted or edited documents in Word (or any other program, or with pen and paper) and propagate the errors to new documents.
In other news:
- Many humans still believe in silly superstitions like flat Earth or that code and data are fundamentally distinct, or that control vs. data plane is anything more than a design opinion that doesn't apply to the universe in general.