There is a lot of unhinged fearmongering around the growing power of LLMs and agentic harnesses. Much of this prattle is from the very people making the product:
"The vast power of superintelligence could also be very dangerous, and could lead to the disempowerment of humanity or even human extinction." – OpenAI
or
"[The] Intellect we don't fully understand" – Jakub Pachocki
Are you good and scared yet? That is the point of those posts.
At the heart of AI is a very clever, but ordinary bit of software called a Large Language Model. This model has only one job: to predict new words that are likely to follow the words it got as input. Are you trembling in terror yet?
So, there is little need to fear powerful large language models. They can only emit text. They cannot read a file, look at a web site, control your mind, or drain your bank account.
The issue is the software that connects the output of the idiot word predictor and attaches that to a set of programs. That is the essence of what are termed "agentic workflows." An agentic workflow is the metaphorical arms and legs of the giant robot lumbering towards you.
Let me cut to my point: Agentic workflows need proper sandboxes.
"Agentic workflows" are actually not a new threat. Information technology has long dealt with programs that use system tools to execute a workflow that the user did not intend. We call that kind of program a "virus", or "worm", or "malware".
So, indulge me for a moment while I cast "agentic workflows" into the most unkind light possible of malicious software. Here, I mean that we don't know what an agentic workflow will actually attempt to do before we run it. It could indeed hijack its host system to do all manner of naughty things.
If you knowingly installed malicious software on your PC that was connected to your corporate LAN, you will, at a minimum, be getting an unpleasant visit from Network Security.
But security experts really do have to install and often execute malicious software to understand how it works and how it can be defeated. They do not put this software on a normal machine. They add multiple layers of network isolation so that is not possible for software to touch systems outside of a testing regime.
That's called being a responsible computer operator. LLMs are operating under your personal authority.
Where are the calls for users of agentic workflows to demonstrate the same level of professionalism and foresight that has long been the practice of computer professionals in other contexts?
LLMs can generate code faster than humans. But worms have done that for years. An LLM could build a compiler on a machine that simply allows it to write to a file system. From there, creating arbitrary executables is only a matter of time.
We trust (mostly) JavaScript to run in our browsers without compromising our machines. Sandboxing is proven technology. Perhaps AI bros can stop pushing us to run their software without limits? Of course, that will cut into subscription fees.
We also need meaningful liability laws around LLM use. If I hack a corporate website, I am going to face legal penalties. If an LLM does this, even without my permission, I should be held liable.
And, lest accusations of Luddism be thrust upon me, I have a local LLM rig in my basement with which I am quite pleased.
Do not trust the technology to be responsible. Hold humans accountable for their actions. The law already works like this in most situations. AI should be no different.