Post

Simon Willison
@simonwillison.net

Another prompt injection paper review! This time it's "An Introduction to Google’s Approach to AI Agent Security" by Santiago Díaz, Christoph Kern, and Kara Olive Some interesting ideas in here, particularly around Google's three core principles for agent security simonwillison.net/2025/Jun/15/...

simonwillison.netAn Introduction to Google’s Approach to AI Agent SecurityHere’s another new paper on AI agent security: An Introduction to Google’s Approach to AI Agent Security, by Santiago Díaz, Christoph Kern, and Kara Olive. (I wrote about a different …

12 reposts80 likes

LambdaDuck
@anka213.bsky.social

if you wanted to build a safer purely LLM-based approach, I can imagine having three separate LLMs: 1. A policy engine that only sees the prompts themselves and suggests permissions for 2 2. The main level 3. An LLM for untrusted input that higher levels never see output of

LambdaDuck
@anka213.bsky.social

Having level 3 may be a bit too restrictive for some usecases, but the policy engine could decide if it’s possible to do what’s requested without level 2 seeing the output. and if level 2 has seen untrusted data, we should ensure that the memory of it gets erased when possible