Rogue Agents - Stop AI from misusing APIs

Transcript

1. Rogue Agents Stop AI from misusing APIs TechTalks SF - Jan ‘24 Dominik Kundel d-k.im/rogue-agents Dominik Kundel | @dkundel
2. Dominik Kundel | @dkundel
3. console.log(` Hi! I’m Dominik Kundel `); dkundel.com @dkundel dkundel@twilio.com github/dkundel Product Lead @ Twilio && JavaScript Hacker Dominik Kundel | @dkundel
4. How can we have AI interact with APIs? Dominik Kundel | @dkundel
5. How can we have AI safely interact with APIs? Dominik Kundel | @dkundel
6. How can we have AI interact with APIs? Dominik Kundel | @dkundel
7. Dominik Kundel | @dkundel How to connect AI to APIs Platforms Frameworks Native LLM Functions 🦜🔗
8. Dominik Kundel | @dkundel Platforms Frameworks Native LLM Functions 🦜🔗 Source: LangChain Documentation
9. Dominik Kundel | @dkundel Platforms Frameworks Native LLM Functions 🦜🔗 Source: LangChain Documentation
10. What’s the problem? Dominik Kundel | @dkundel
11. Dominik Kundel | @dkundel
12. Dominik Kundel | @dkundel
13. Unpredictable Dominik Kundel | @dkundel
14. Dominik Kundel | @dkundel Easily Impressionable
15. Dominik Kundel | @dkundel Source: Simon Willison - Prompt Injections: what’s the worst that can happen?
16. Dominik Kundel | @dkundel Source: Simon Willison - Prompt Injections: what’s the worst that can happen?
17. Dominik Kundel | @dkundel Source: Simon Willison - Prompt Injections: what’s the worst that can happen?
18. Dominik Kundel | @dkundel Rules are “suggestions”
19. Dominik Kundel | @dkundel Source: Simon Willison - Prompt injections explained
20. Dominik Kundel | @dkundel Source: Simon Willison - Prompt injections explained
21. Dominik Kundel | @dkundel The problems with LLMs Unpredictable Easily Impressionable Rules “suggestions”
22. Dominik Kundel | @dkundel
23. How do we “LLM-proof” our APIs? Dominik Kundel | @dkundel
24. Dominik Kundel | @dkundel
25. Dominik Kundel | @dkundel
26. Dominik Kundel | @dkundel
27. Dominik Kundel | @dkundel
28. Dominik Kundel | @dkundel LLM
29. Dominik Kundel | @dkundel
30. Dominik Kundel | @dkundel
31. Dominik Kundel | @dkundel
32. Dominik Kundel | @dkundel
33. Dominik Kundel | @dkundel LLM
34. What security measures? Dominik Kundel | @dkundel
35. Dominik Kundel | @dkundel Security Measures
36. Dominik Kundel | @dkundel Security Measures Data Validation
37. Dominik Kundel | @dkundel Security Measures Data Validation Rate Limiting
38. Dominik Kundel | @dkundel Security Measures Data Validation Authentication Rate Limiting
39. Dominik Kundel | @dkundel Security Measures
40. Dominik Kundel | @dkundel Security Measures Authorization
41. Dominik Kundel | @dkundel Security Measures Authorization Least Privilege
42. Dominik Kundel | @dkundel Security Measures Authorization Eliminate con fi dential & unnecessary data Least Privilege
43. Dominik Kundel | @dkundel Do threat modeling!
44. Dominik Kundel | @dkundel Takeaways?
45. Treat AI-exposed APIs as public Dominik Kundel | @dkundel Takeaways?
46. Treat AI-exposed APIs as public Security mechanisms outside AI world Dominik Kundel | @dkundel Takeaways?
47. Treat AI-exposed APIs as public Security mechanisms outside AI world Dominik Kundel | @dkundel Takeaways? Toddler-proof your home API!
48. console.log(` 💖 Thank You! 🎉 `); dkundel.com @dkundel dkundel@twilio.com github/dkundel d-k.im/rogue-agents Dominik Kundel | @dkundel | #workfromhomeconf |