How hard would it be to have one installation step to be to have Claude read through all the code to the extension and strip out anything that looks risky (ie. Calls out to external servers).?
Do that automatically for all code downloaded from the web and run outside a sandbox.
Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.
That's certainly a great way to waste even more resources at a massive scale.
Why is the answer for Javascript developers "don't use leftpad" but for the AI crew it's "convert the source code to tokens and attempt to strip out the bad stuff without breaking the rest"?
1. We've seen LLMs detect existing supply chain attacks when pointed at malicious install scripts. This is direct, empirical support for my position.
2. We have a long history of using heuristic technologies to detect attacks. We can infer that other heuristic technologies can be combined in a successful manner.
3. Shortcomings of LLMs are directly addressed by removing attacker controlled information from the input, which I specifically called out (using tools like grep for pattern matching + using sub agents to isolate contexts). This has been demonstrated already in a number of ways - feeding the LLM derived facts instead of attacker controlled data is the well worn path to avoiding injection attacks.
I have this for my cargo dependencies. `cargo-vet` will block anything not approved, and then I have a skill that reviews every dependency before trusting that version.
Do that automatically for all code downloaded from the web and run outside a sandbox.
Maybe won't catch everything, but should catch most evil stuff, especially if a variety of models and prompts are used.