Why chat assistants fail at delegation, and a security model to fix it
uriwa · reddit · 2026-09-11
The author argues most conversational assistants are stuck in a middle ground: in a browser tab they can only draft text, but adding execution usually swings to the opposite extreme—local scripts with direct user credentials, or raw API keys in the prompt.
Real delegation needs three decoupled primitives:
- Decoupled execution: no local machine, no idle-burning shared infra; spin up an ephemeral Linux sandbox on demand with a real terminal, compiler, and browser automation.
- Out-of-band verification: once an agent executes code, anyone in a shared channel can attempt prompt injection. Structurally, non-owner requests for execution, data export, or system changes must pause and trigger a one-tap WhatsApp approval to the owner.
- Egress-locked secrets: credentials injected at the proxy boundary so the model never sees plaintext keys.
Built for Mentat on prompt2bot: Google Calendar scheduling, answering calls, private dashboards on isolated cloud machines.
More from coding & agent
- Ten lessons from three years building agents for real production work — garrytan · 2026-09-11
- Devin's New Model Verdict: Not a Benchmaxxer, a 'Killer Execution Model' at $20/Month — brandon_galang · 2026-09-11
- Shopify CEO Tobi Lütke hails single-dev open-source agent harness Pi — aakashgupta · 2026-09-11
- Shopify CEO Tobi Lütke Calls Pi, a Solo-Dev Open-Source Agent Harness, 'the Most Interesting' One — aakashgupta · 2026-09-11
- Dev explains why MCP won him over: organic UX beats telling agents to run CLI commands — zeeg · 2026-09-11
- Sentry Founder: MCP Won Because Agents Can Just 'Fix This URL', Not Call CLIs — zeeg · 2026-09-11