Hacker News Reader

What isolation is there? If a compromised sub agent returns data that gets inserted into the main agents context (structured or not) then the end result is the same as if the main agent was directly interacting with the compromising resource is it not?

View on HN

Exactly. You can't both give the model access AND enforce security. You CAN convince yourself you've done it though. You see it all the time, including in this thread.

Perhaps a reference to the data can be inserted in prompt. thee key or filename

Reply on news.ycombinator.com