Post History

One approach would be to containerize AI activity. For example:

* Create a folder to serve as the AI's workspace
* Create a Docker container
* Use bind mounts to mount the workspace to the container
* When fulfilling the function calls requested by the AI, do so inside the container

The container will not allow access to files which are not mounted. In principle the AI could modify the system files of the container itself, but you can simply delete the container and create a new one.

Note that while containers provide pretty good isolation, it is not foolproof and privilege escalation vulnerabilities have been discovered which allow an attacker to "escape" from the container.

Also, keep in mind that while this protects your filesystem from access by the AI, it does not by itself prevent the AI from accessing network resources.

A more robust way to limit the AI's file access would be to do so at the application layer, by checking the path of the file against a white/black list before even attempting to execute the function. This requires more explicit implementation of access rules and modifying the code of your application, however it gives you more control over the restrictions imposed.

When the AI attempts to access a forbidden file path, you can return a generic English error message like "Access forbidden by user". LLMs seems able to interpret this and proceed logically.