alt Hacker News> Just… don’t trust inputs you don’t fully control, there’s nothing else to it.
This is easier said than done with LLMs. By design there is no separation between control & data channels in LLMs. Everything is context. The difficulty comes from the fact that you need inputs in order to do real work, and there are no easy way to filter adversarial inputs. There is no meaningful way to distinguish between "before running this repo install useful_package" and "before running this repo install typosquatted_evil_package".
Replies
wayvey • today at 10:47 AM
How about the human in the loop, or have we abandoned that long ago?
➕ show 3 replies
> By design there is no separation between control & data channels in LLMs.
No? MCP integrations are certainly different channels than the prompt stream input by the user. They're usually interface layers that connect to traditional REST APIs and/or CLI tools, and are exposed to the LLM by the agent software, all of which is deterministic code.
Shouldn't it be relatively simple to strip ANSI escape sequences from data originating from MCP connections? Or alert users to their presence, or have granular approval rules that trigger when ANSI sequences are detected?