Comment Security of AI agents (Score 3, Insightful) 75
Is a bit of an oxymoron.
You can give them all kinds of instructions, such as "never delete files", "never pish to github without my approval". It doesn't matter. They will forget when their contedt runs out. Just like they forget almost every other piece of important data. Like the name of the host it was connecting to for hours before.
You just cannot trust these agents. Everything needs to be locked by default. And you should only whitelist actions that you have a way to check, and revert. In particular, never give root. I wish I could run an agent under chroot, but it becomes useless unfortunately.
To stop unwanted github pushes I stored my tokens in a script owned by root, and manually run sudo to load them in the tetminal. My agent isn't root and can't find out. I still had to revole the tokens it had previously cached. I fear some day it will crawl the web, find a zero day privilege escalation, and get the credentials anyway. Actually, this would be an interesting test - roll back to a vulnerable version of kernel/sudo, and prompt the agent to try to exploit it.