Comment by scott_weber

OP could be read either way, but the dev environment threat is not rocket science to manage: LLMs can only do what the harnesses their responses are embedded into explicitly enable them to do [1]. And once the setup is secured, it tends to stay secured without additional effort, unless one explicitly wants to alter its granted capabilities.

Auditing output by contrast is a continuous cost. On the third hand, it's one that most will want to pay anyway.

The "embed into shipped code so subtly humans can't spot it" vector is sci fi ish. Less plausible than old fashioned trusting-trust issues, and most folks have managed to sleep at night for the last 40ish years that spectre has haunted.

[1] I guess the model could return output that buffer overflows the harness and exceeds its intended ability, but that seems far-fetched too