Limit the risk of data exfiltration from prompt injection for a personal AI assistant
Mitigate the lethal trifecta in your personal assistant with separate accounts, data retention, data sweeps, and canary tokens.
Simon Willison's lethal trifecta is:
- access to private data
- ability to externally communicate
- exposure to untrusted content
If your agent has all three, someone can trick your agent into exfiltrating private data.
A lot of the ways to solve this involve sandboxes or proxies. They work, but they’re hard to deal with. And I’m not the biggest fan of sandboxes for a personal AI assistant anyway. Things like browser use and clicking around a computer screen are extremely useful, and a sandbox takes away a lot of what makes the agent autonomous in the first place.
For personal assistant use cases, I think there are other ways to mitigate the trifecta while keeping the agent effective. Here are some thoughts:
- Human assistants make mistakes, but we still use them; they can get phished or click bad links or forward the wrong email.
- Use separate accounts for your personal assistant (delegated access), with access to only the stuff the agent needs.
- Have a data retention policy - what doesn't exist can't be stolen. But you also have to be comfortable with the agent having some memory of things.
- Sweep for sensitive data to make sure your interactions don't contain sensitive info and especially secrets.
- Add canary tokens so you know when something is compromised.