As you point out this portal isn't that, but what protects us is the processes around compliance. This can't grow from X to Y because not even the CEO has the authority to overwrite our compliance gates. The EU is a tremendous help in this area since personal liability changed things completely.
> We're in the European economic area and are completely NIS2 compliant and we use LLM's to aid in our software development for high risk systems.
Please pick one. Either way this is a nightmare level of threat to sovereignty.
I still doubt we will ever give an AI access to run code on our systems directly though. In isolation, sure, but other than that.
This is a side note, but my personal favorite part of Cowork is that I can roll out our compliance policy to every developer as a Microsoft Teams app (no, that makes no sense to me either). So when they try to install some package that isn't pre-approved their Cowork agent won't let them and will instead explain how they might get approval. If they then continue to reference it, Cowork will even alert us.
Well, I'm speechless.
Not OP, but I opened the link to the comment and it was six months. I get why you're skeptical, and I think it's fair to point out. But that's sort of glaring when I opened the link to contextualize your comment.
If you really want to go into it, I've previously talked about how we used AI tools provided to us by one of our major investors who do so for all the companies they are invested into. These were also Anthropic and OpenAI models. The main difference is that Cowork has access to files on a users one drive (and that we get a lot more control over what goes into it).
You work in the extreme opposite setup to mine. VC vs bootstrapped. LLMs vs hand-coded. High margins vs open-source. If you ever look at our codebase, you will see that there are very few code dependencies, and of course bringing in another as large as LLMs is not in scope.
If you wish, we can always continue our exchange by email (mine is in hn profile).
If you just get cowork directly through claude you do get generous usage within their 20$ subscription.
I have to use it through Microsoft too because of their lobbying our company but I don't think they won any war. They're just reselling other people's stuff. The integration with office is alright but I don't really rely on that. In my personal life I avoid them.
I agree, the EU can't become sovereign or have privacy, if the citizens constantly work against it.
From my perspective it looks like were just allowing hostile developers within our environments now lol.
In the big threat picture a vibe coded web tool that's not on the internet and runs in total isolation on it's own management group on the "this might get hacked" tenant in Azure is nothing though. I'd worry more about all that OT which was compromised from the factory which sits around in the energy sector. Especially because it's very easy to draw you a risk analysis that will tell you that unless you're running a Nuclear Powerplant then it makes no financial sense to secure your stuff. The audits are so rare and the consequences so low that it's cheaper to just pay the fine (if you ever get one).
Most actual security happens when someone on the ground decides that it's just too stupid that something clearly labeled "DO NOT PUT ON THE INTERNET" was put directly on the internet.
The insecurity in a vibe-coded web portal isn't that someone hacks it with XSS, it's that after the next vibe-coded release, some X quietly becomes −Y somewhere no one expects.
From this perspective, having no software at all might be better, or as in your case, safer.