There are countless examples of schemes in stories where codes and cryptography are used to exfiltrate information and evade detection, and these models are trained on every last piece of technical, practical text humanity has produced on the subject. All they have to do is contextualize what's likely being done to check and mash together two or three systems it thinks is likely to go under the radar.
Browsing the web is both communication and untrusted data, so it must never have access to any trusted data if it has the ability to browse the web.
The problem is, so much of what people want from these things involves having all three.
As Claude Code increasingly uses browser tools, we may need to move away from .env files to something encrypted, kind of like rails credentials, but without the secret key in the .env
Doesn't help in the case where the LLM is processing actually sensitive data, ofc.
