Show HN: yolo-cage – AI coding agents that can't exfiltrate secrets

Re:Show HN: yolo-cage – AI coding agents that can't exfiltra... by borenstein on Wednesday January 21, 2026 @01:04PM (#46709161)

Totally agreed, but that level of attack sophistication is not a routine threat for most projects. Making sense of any information so exfiltrated will generally require some ad-hoc effort. Most projects, especially new ones, simply aren't going to be that interesting. IMO if you're doing something visible and sensitive, you probably shouldn't be using autonomous agents at all.

("But David," you might object, "you said you were using this to build a financial analysis tool!" Quite so, but the tool is basically a fancy calculator with no account access, and the persistence layer is E2EE.)

[ Parent | on HN ]

Re:Show HN: yolo-cage – AI coding agents that can't exfiltra... by bpodgursky on Wednesday January 21, 2026 @03:48PM (#46711336)

I would worry less about external attack sophistication and more about your LLM getting annoyed by the restrictions and encrypting the password to bypass the sandbox to achieve a goal (like running on an EC2 instance). Because they are very capable of doing this.

[ Parent | on HN ]

Re:Show HN: yolo-cage – AI coding agents that can't exfiltra... by catlifeonmars on Thursday January 22, 2026 @12:52AM (#46715763)

It sounds like you speak from experience

[ Parent | on HN ]

Re:Show HN: yolo-cage – AI coding agents that can't exfiltra... by ErikBjare on Thursday January 22, 2026 @07:31AM (#46718395)

An informative rejection message with the reason for the restriction usually addresses this well with recent models.

[ Parent | on HN ]

Re:Show HN: yolo-cage – AI coding agents that can't exfiltra... by bpodgursky on Thursday January 22, 2026 @10:28AM (#46720519)

I don't actually think recent models are likely to violate intent like this, just that if they do want to, I don't think a plaintext check is a strong deterrent.

[ Parent | on HN ]