Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #4176] The Lethal Trifecta #2657

New Issue
Closed
opened 2026-02-22 18:30:38 -05:00 by yindo · 2 comments
yindo commented 2026-02-22 18:30:38 -05:00
Owner
Copy Link
Copy Source

Originally created by @ericthomas1 on GitHub (Jul 18, 2025).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4176

Hello,

How does AnythingLLM protect against the Lethal Trifecta, especially with Agent skills that browse the web?

Is there anything happening behind the scenes that prevent the data uploaded to AnythingLLM from being exfil'd or otherwise maliciously interfered with?

Thank you

Originally created by @ericthomas1 on GitHub (Jul 18, 2025). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4176 Hello, How does AnythingLLM protect against the [Lethal Trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/), especially with Agent skills that browse the web? Is there anything happening behind the scenes that prevent the data uploaded to AnythingLLM from being exfil'd or otherwise maliciously interfered with? Thank you
yindo closed this issue 2026-02-22 18:30:38 -05:00
yindo commented 2026-02-22 18:30:38 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 18, 2025):

We do not interpret data from a website during scraping so even if there were commands in that page, they would not be interpreted as instructions. This would specifically impact browser-use agents. The system does not self-invoke actions as always, the first line of defense is just...not doing that?

You could probably set up some system of unchecked permissions and crazy custom-coded tools to brick your computer, but it would never be an accident and there would have been about 400 times prior to that happening that would have avoided it.

@timothycarambat commented on GitHub (Jul 18, 2025): We do not interpret data from a website during scraping so even if there were commands in that page, they would not be interpreted as instructions. This would specifically impact browser-use agents. The system does not self-invoke actions as always, the first line of defense is just...not doing that? You could probably set up some system of unchecked permissions and crazy custom-coded tools to brick your computer, but it would never be an accident and there would have been about 400 times prior to that happening that would have avoided it.
yindo commented 2026-02-22 18:30:38 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Jul 18, 2025):

In that article it highlights several MCPs that were used to do some kind of exfiltration. We support the use of MCPs, but certainly don't pre-install them for anybody. Not only for this reason, but also just general confusion + lack of observability into MCPs in general.

MCPs in particular are suspecitble to this since they tend to be useless with too little permissions and too dangerous if given too many permissions

@timothycarambat commented on GitHub (Jul 18, 2025): In that article it highlights several MCPs that were used to do some kind of exfiltration. We support the use of MCPs, but certainly don't pre-install them for anybody. Not only for this reason, but also just general confusion + lack of observability into MCPs in general. MCPs in particular are suspecitble to this since they tend to be useless with too little permissions and too dangerous if given too many permissions
yindo changed title from The Lethal Trifecta to [GH-ISSUE #4176] The Lethal Trifecta 2026-06-05 14:47:48 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#2657
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?