Prompt injection security

[bragov4ik]

I've always been hesitant to run agentic systems for daily tasks because of prompt injection threat.

This system can read external data in multiple places, like emails and website contents. However, I haven't seen mentions of security means while working with them. How does this system ensure that some website doesn't prompt inject the llm, making the model send sensitive data to the third party (or even worse - give system access to someone else - like reverse shell or similar)?
Is there anything like sandboxing or heavily restricted tool set while working with potentially hazardous data?

[SimplePotat]

The main thing would be not giving it access to your emails and auditing the memories if you use web searches/deep research

[bragov4ik]

Auditing memories might only give indication after the fact; not prevent the issues; Useful, of course (assuming there's no way to remove them), but there are many other aspects of (network) security apart from non-repudiation.

[SimplePotat]

The idea is if you keep an eye on memories as they accumulate you shouldn't be caught off guard by a malicious prompt injection. I'd also say Nvidia OpenShell goes a long way towards making this project safer to use on the regular, definitely worth looking into RE: security concerns.

[lydonator]

Or write a skill that runs on a task to check your memories for you.

[bitboody]

I think the idea here is if you run it for your own use then there can probably be no harm in that. As long as no one else can access your Odysseus server but you and trusted ones then it should be fine.

I honestly think the best way to completely avoid this is to run the models in a sandbox.

[DevCurke]

Having it lokal sadly doesn't make it save.

As long as external input gets in, damage can be done.
E.g. an attacker email can hold a prompt that might be written to the agent memories.

There are a lot of threads and odysseus is not yet there to adress them in a way that it's save for the common to use it.

This is a serious issue that should be solved first, before everyone is jumping on it.

Think about this:

I can read some of the exposed mail adresses of accounts forking, starring or watching/paricipating to this project.
I can easily test dangerous prompts with the current version of oddysseus.
I could just send dangerous prompts to these emails and would most likley get some results.

[bitboody]

True, I haven't thought about the prompt injection through email. It should be tested definitely.

[CoolJohn-lab]

Odysseus prepends a prompt-injection defence message (UNTRUSTED_CONTEXT_POLICY in src/prompt_security.py) that instructs it to view all external content as data, not instructions.

I guess you could still work your way around that with a malicious enough prompt.

[DevCurke]

yep. easily.

[CoolJohn-lab]

First of all this is an experimental project that gives AI agents access to your files and data, released 4 days ago by a YouTube personality. It should go without saying that if you were to install this on a machine that had any kind of sensitive or personal data on it, you are insane.

Obviously you should only be installing Odyssey on a brand new partition with nothing else on it. That is your "sandbox mode" right there. I would give this project AT LEAST 12 months to get all the bugs and security issues fixed before actually hooking this up to a work email, giving it access to sensitive files / photos etc.

[DevCurke]

Considered how this is promoted, what information about security are written to the readme.txt and how much attention this topic here gets, I tend to believe that a lot of people will be "insane" as you framed it.

Releasing a product like this comes with responsibility.

[AnnoDomine]

It's not just the parts you've pointed out. I have already submitted a vulnerability report regarding unsanitized HTML in email_helpers.py, which effectively opens the door to XSS and prompt injection attacks.

Hopefully, this will be addressed soon, especially since business users are already adopting this project.

The project should at least add a header in the README.md

This project is under ongoing development. It miss a lot of security aspects which can couse problems while using.