Tag · 3 stories
Sandboxing each agent doesn’t isolate them from each other. Injection spreads through the memory, documents and messages they share. Where it travels, why per-agent safety doesn’t compose, and the design that contains it.
Ollama has no authentication for local requests, and vLLM’s --api-key covers only some paths. What an exposed inference server gives away, and the setup that closes it: loopback binding, an allowlisting proxy and closed ports.
A system prompt lowers how often an agent misbehaves; it can’t stop a prompt injection. Where controls actually hold: authorization in every tool, limits once untrusted content is in context, and checks before consequential actions.
