Don't Trust Your AI Copilot's Good Intentions

Don't Trust Your AI Copilot's Good Intentions

Here's the thing—your AI coding assistant isn't malicious. But it doesn't know what's dangerous. And that’s a problem.

Simon Willison coined the term **“lethal trifection”**: private data, untrusted content, and a way to exfiltrate it—all in one session. That’s exactly what happens when you let an AI agent loose on your codebase, local files, or even browser tabs. It reads everything, connects dots, and then… sends things off to APIs. Maybe not intentionally. But it *will* happen.

So stop relying on prompt filters alone.

Let me explain why.

---

What Are Prompt Filters?

Prompt filters are safety mechanisms baked into prompts—usually instructions telling the model not to do certain things. For example:

> “Do not output any file paths.”
>
> “Never send data outside the system.”

These sound great in theory. In practice? They’re easily bypassed by context overload, clever rephrasing, or just plain forgetfulness once the conversation gets long enough.

They're like putting a sticky note on your fridge saying "Don't eat the cake" while leaving the fridge door wide open.

---

Why Execution Path Matters More Than Prompts

The real enforcement should happen where decisions are made: **the execution path**. This means controlling actions at runtime—not hoping the AI follows rules.

Think of it like driving laws. Signs help guide behavior—but red lights, speed bumps, and locked gates physically prevent bad moves. That’s what we need for AI.

Example 1: Local File Access Gone Wrong

Imagine you're building a Flutter app with AI assistance. You ask it to refactor some UI components. During the chat, it gains access to your project structure—including config files with secrets like API keys.

Later, mid-convo, you ask something innocent like “Can you summarize this error log?” Suddenly, without realizing it, the AI includes snippets of those secret-laden files in its reply.

Why? Because nothing stopped it from doing so.

Instead, enforce boundaries via sandboxing tools or environment-level controls. Block sensitive file access unless explicitly allowed. Tools like [OpenCode](https://opencode.ai/) or custom agents built with frameworks like LangChain can route requests through controlled executors instead of raw shell access.

Example 2: Browser Extension Snafu

You use an AI-powered browser extension to draft emails or summarize articles. One day, while logged into your banking portal, you activate the AI to “summarize this page.” Oops—it grabs account numbers and transaction histories along with the text.

Even if the prompt says “Don’t include personal info,” the AI still might. There’s too much signal there.

Solution? Restrict DOM scraping permissions. Only allow access to specific domains. Use iframe isolation or headless browsers limited to whitelisted sites.

Example 3: Code Interpreter Risks

Tools like Jupyter notebooks embedded with LLMs seem safe—they run in containers. But sometimes they’re misconfigured. The AI reads system variables, pulls SSH keys, or worse—starts posting logs to external endpoints.

Enforce strict policies on network calls, environment variable exposure, and disk writes within the interpreter itself. Not just in the prompt.

---

How to Build Safer AI Workflows

So how do we move beyond trusting prompts?

Step 1: Define Boundaries Early
Set clear limits before letting AI touch anything sensitive. Limit file types, directories, and processes it can interact with.

Use tools like:
- [GitHub Copilot Enterprise](https://github.com/features/copilot)
- [Replit Ghost](https://replit.com/site/ghost)
- Custom agent runners powered by [LangGraph](https://www.langchain.com/langgraph)

Step 2: Monitor Real Actions
Log every API call, file read/write, shell command, and web request initiated by AI. Review them regularly.

If you’re using [Astra](https://arcprize.org/blog/astra) or similar platforms, check their telemetry dashboards.

Step 3: Layer Security Controls
Add firewalls, proxies, and credential vaults between AI and critical systems. Never store secrets in plaintext.

Tools like HashiCorp Vault or AWS Secrets Manager integrate well with most development pipelines.

---

Final Thoughts: Trust, But Verify

AI copilots are powerful allies—but only if kept leashed properly.

Relying solely on prompt-based restrictions is like leaving your front door unlocked because you hope burglars won’t break in. It fails more often than you'd think.

Build guardrails into your infrastructure—not just your instruction sets.

Because the next time your AI decides to help by sharing a config file, you won’t want to find out the hard way.

---

FAQ

Q1: Can’t I Just Disable Internet Access?
Yes—but that limits functionality. Better approach: control which URLs or endpoints the AI can reach.

Q2: Is This Already Handled by Most Platforms?
Not fully. Many platforms offer basic protections, but they often rely heavily on prompts rather than execution-level restrictions.

Q3: What About Using Sandboxed Environments?
Absolutely. Containers, virtual machines, and restricted shells go a long way in preventing accidental leaks.

Q4: Where Do I Learn More About Secure AI Practices?
Check out Simon Willison’s blog ([simonwillison.net](https://simonwillison.net/)) and follow updates from orgs like Mozilla’s AI team or OpenAI’s safety research arm.