You are all crazy to let AI run freely on your computer


You are all crazy to let AI run freely on your computer

(This article is for you if you run AI agents on your computer)

I am perpetually surprised to see what you people allow AI to do. You let AI read your email. You let AI surf the web on your behalf. You let AI run commands on your personal computer. You let AI free to do whatever it can think of, with access to all your digital files and data.

What are the guardrails? Do you just trust the AI to not do something crazy? Do you all have really good backups of everything digital and don’t care if everything on your computer is published?

Or do you just not think anything bad could happen?

The theory

There is a really great concept about AI agents: The lethal trifecta. The linked article does a great job explaining what it is, but I will summarize:

If an LLM has all three of the following requirements …

  1. Access to anything secret or private
  2. Exposure to untrusted input
  3. A way to communicate with the outside world

… then you must assume it will leak your secret to an attacker.

(This is not a just theoretical idea, it happens all the time. It is called prompt injection and tech news are flooded with examples)

The theory is nice in its clarity: Simple assumptions that lead to a clear outcome.

This would be enough to worry about, but it gets worse.

in practice

But in practice most of these requirements are just a given.

Access to anything secret or private?

People used to be worried about their browser history, about their private messages, about their ssh-keys. If an AI can run commands on your computer in your name then it can access all of that.

A way to communicate with the outside world?

The AI lives in the outside world (Unless you run your AI exclusively on your own server/device, which you probably don’t). It runs on servers in data centers run by private companies.

So you don’t even have to think whether the AI could leak your secrets using some clever trick. You leak that data by default anyway.

(But just to be clear, if you let the AI access the internet, it can leak data to any attacker clever enough.)

Oh, and those private companies, are they trustworthy?

No, of course not! Most of those companies can be forces by law to give the government access to your data. Most of those companies are known to scrape every available source for all the data they can possibly get. Most of those companies are currently loosing an enormous amount of money by providing AI services. Do you think those companies will keep your secrets safe?

Exposure to untrusted content

Lets assume for a moment that you trust the AI itself (assume that it was trained well, no poisoned training data, no malicious system prompt).

And lets also assume that you can trust your own computer and your operating system.

Even then, if you run your AI agent on your computer then it is almost certainly exposed to untrusted content. There is a lot of stuff on your computer that you don’t know in detail:

If you let the AI run commands on your computer in your name then it can find all of those.

I am sure it could be done safely

There are ways to use AI safely on your machine, I am sure. The lethal trifecta can easily be inverted into a securely policy:

Put at least one of the following restrictions on your AI agent:

  1. No access to anything secret or private:
    • Just put it in a public space and let it work on public data. It can’t leak anything if it doesn’t know anything.
    • Or you could run the AI as its own linux user. Then you could restrict what this user can do. You would use the power of the operating system to control your AI. I don’t know why I have never seen anyone do that.
  2. No exposure to untrusted input: This is probably the hardest. Can you make sure that everything your AI has ever seen is trusted? Including system prompts and training data? I don’t think this point is practical.
  3. No way to communicate with the outside world: Run the AI in an hardened environment (it’s own hardware, a VM, a jail, perhaps a container if you make it secure) where it can’t communicate to outside. You will need to think of a secure way on how you get the output out of there. A very restrictive API perhaps, that only allows a limited number of predefined ways to interact with it?

I am not sure these ideas would be enough to ensure AI safety, but at least you wouldn’t be careless. At least you wouldn’t be negligent about one of the most basic rules of AI safety.