Comment by skissane

> This is war where you are under active attack and the attackers adapt quickly.

It all depends on what the use case is.

For example, consider a system which takes English questions from business users, translates them to SQL, then runs it (as the business user) against a reporting database

How does the attacker get access to it? And even if they somehow do, what harm can they actually do to it? The only tool it has is one to run SELECT against a DB, and it can only SELECT data the user already has access to, and we have timeouts/etc to protect against overly expensive queries

If your design involves lots of general purpose do-anything agents with very generic tools, the risk profile is very different from narrowly scoped purpose-specific AI services