@simonw Keeps His Agents Out of Production

Least privilege, even for a model that resists injection.

Replying to @adamhjk and @nateberkopec, @simonw says he is still nervous about straightforward agent mistakes. He does not let his agents have production access to modify deployed services, except on some dedicated test accounts.

On the “externally communicate” leg of his rule, he clarifies: it is about being able to send data back out. If a system can fetch data but not send it, there is no exfiltration hole.

He also draws a line between two attacks. Classic prompt injection mixes malicious third-party text with trusted instructions. In the README case, a document the agent was told to follow asks it to run a setup script. The model does exactly what its user told it to do, @simonw writes, but the user delegated a task that would have harmed them.