logoalt Hacker News

ks2048today at 1:03 AM2 repliesview on HN

So is “you can make GET requests, but not POST requests” an actual form of security people use?


Replies

NegativeLatencytoday at 1:12 AM

Yes, there was an OpenAI trial that was using that in combination with a forum to coordinate among agents

comeonbrotoday at 1:10 AM

Unrealistically-naive (...) forms of "sandboxing" might assume that restricting an agent to GET-requests-only will let it retrieve info from the outside world without being able to effect it.

Also probably many actually-in-use "Web Fetch" tools are GET-only, though perhaps without counting on that bad assumption.