So what you have to do instead is say, "Okay, fundamentally these things we cannot prevent if there's malicious instructions, consider that anyone who can talk to your agent can make it do any of the things it's allowed to do," and then you have to think, "Okay, well, let's make sure that the blast radius on that is limited. The things that it's allowed to do can't cause too much damage." This is why I use Claude Code for web so much because I'm often having it go and read random webpages and maybe those have nasty attacks on them. All it can really do if it's running on Anthropic servers is waste their... It could mine Bitcoin on their servers or something, or maybe leak some of my private data somewhere else, but I don't put my private data into that environment.
It could mine Bitcoin on their servers or something, or maybe leak some of my private data somewhere else, but I don't put my private data into that environment.