MikhailTal
a day ago
Very fascinating, super interesting engineering. Although i do find it very funny how they just bypass a massive vulnerability, basically zero data isolation (even between good actors, let alone bad ones) with 3 sentences. Only in the llm space you can slap a massive limitation like this in the middle of the article and continue like nothing happened
> Whatever anyone tells Audel becomes part of the single experience that every other conversation draws on. In practice, Audel is bad at keeping secrets. Ask it what it’s been working on with someone else and it will often just tell you, even though we’ve asked it not to. We also haven’t studied what happens when two people give conflicting instructions. For now, we assume anything you tell Audel is shared with everyone on the team.
embedding-shape
a day ago
I'm curious, you say "super interesting engineering" but then they say "it will often just tell you, even though we’ve asked it not to" and to me that seems like extremely shit engineering.
Where are the interesting engineering parts at? Seems to be an interesting idea and perhaps design, but to call the implementation/engineering itself bad seems to be an understatement.
fc417fc802
a day ago
The security and the overall engineering were entirely separate items in that comment I think. It was explicitly called out that this is a security problem that you'd really only see treated in this manner in the LLM space. For what it's worth it's effectively unsolvable (AFAIU) short of realizing AGI with an amicable alignment.
embedding-shape
a day ago
What do you mean unsolvable? Don't give the LLM access to stuff it shouldn't, this is like Access Control 101, not sure how anyone can claim that particular problem is unsolvable?
fc417fc802
a day ago
Just don't give the hammer access to the nails they said ...
bbor
a day ago
Good engineering means optimizing the things you care about, at the cost of things you don't. In this case, secrecy doesn't matter kinda inherently.
It's like criticizing Reddit for not handling SSNs well; the intended design is 'just don't do that, cause you'd never have a reason to, anyway'
rendaw
a day ago
If secrecy doesn't matter, why did they tell the agent not to divulge stuff in the first place?
andyk
a day ago
Should maybe have said more loudly in the posts that this is not intended to be disciplined engineering (or used in prod!) we did think about the architecture quite a bit and we've tried a bunch of different things out. We are fully optimizing for velocity of research experimentation and iterations on the design vs engineering hygiene
i've been playing with the project and idea for years now. the codebase started as javascript plus supabase before reasoning models were a thing (i incorrectly predicted the world would call reasoning models Large Thinking Models - bahaha). at one point the focus was almost entirely on a really easy-to-use human prosemirror UI for editing the agent's thought stream--because the models were still so bad at reasoning at that time.
then we pivoted to all bash at some point since it simplified things and i have this hypothesis that the LLMs will do better if as much of its world as possible is command line operations (inspired by terminus the agent we built as part of the terminal bench project)
the bash implementation is entirely written by coding agents - the human time goes into iterating with an AI agent on the design docs in the ./design folder
re security model - i think of the project as a research experiment about what it's like to treat an agent more like a person - so for secrets you have to trust its judgement about what it will share or if it will betray your trust. I don't know the OpenClaw architecture in great depth but my sense is that none of the LLM based agents that can interact with multiple people have strong guards in place that prevent the agent from leaking secrets between people. Definitely an interesting area for research though!
so yeah security is not a priority in this research per se - easier to assume you don't share sensitive things with a headlong agent
Along those lines, because we keeping it research and optimizing the velocity with which we can try new things out, the current aim isn't necessarily to get a bunch of community contributions. but if we do start to get any i'm thinking we will actually require people to only create PRs with design docs (no code allowed) and maybe even also require the logs (or at least the human prompts and the agent's responses) from the coding session where they created the design doc.
maybe i should write up the history, philosophy, and big picture aims of the project at some point
jeffsheldon
a day ago
The part they punt on ("we haven't studied what happens when two people give conflicting instructions") is the interesting part. That's not a memory problem, it's an authz problem. If everyone writes into one shared stream then there's no model of whose instructions bind the agent or who can override whom. It's resolving the conflict that will generate the greatest "learnings" and advance the agent. This basically becomes a tool designed to misbehave rather than a tool that will learn creatively.
We all know how conflicting instructions to AI end - "I'm sorry Dave. I'm afraid I can't do that"
goodra7174
a day ago
[dead]