tomfutur

At this point I'm so used to evil defaults, reverse psychology could work. Make the "deny all" button bright blue and the "gimme ads and viruses" button pale gray, and you might just catch me.

I think rozab has it right. What executes exfiltration request is the user's browser when rendering the output of the LLM.

It's fine to have an LLM ingest whatever, including both my secrets and data I don't control, as long as the LLM just generates text that I then read. But a markdown renderer is an interpreter, and has net access (to render images). So here the LLM is generating a program that I then run without review. That's unwise.

Besides complexity, a price you pay with multi-armed bandits is that you learn less about the non-optimal options (because as your confidence grows that an option is not the best, you run fewer samples through it). It turns out the people running these experiments are often not satisfied to learn "A is better than B." They want to know "A is 7% better than B," but a MAB system will only run enough B samples to make the first statement.