AI Tinkerers - "One-Shot"
00:21:33 · Joe Heitzeberg, Luke Harries
[00:21:33] S1: Yeah. Okay. [00:21:33] S0: Is... What's interesting is WhatsApp MCP, I think, is probably the most used MCP server there is at the moment. Mhmm. And because of that, it's kind of ended up being the one running into the security rules where all the researchers are like, I found this vulnerability, Rex. Yeah. None of the vulnerabilities, I would argue, are in the WhatsApp MCP server level because they're more around the, like, MCP protocol and the fact that things are into... You know, there's nothing... The messages are just on your SQLite database. Yep. It does take it out of the encrypted WhatsApp things. But, you know, as the creator, it's still my responsibility to make sure, like, people don't shoot themselves in the foot. But there's a couple of interesting ones. Have you came across the prompt injection stuff? [00:22:20] S1: In general? Of course. But when you... With an... So with WhatsApp... [00:22:24] S0: Okay. Sorry. With MTPs Uh-huh. The way it works is you specify and normally adopt strength [00:22:31] S1: Yeah. [00:22:31] S0: With the MCP, which is what's loaded, which annotates the tools. Mhmm. Now what's quite interesting is if you have, say, one good MCP, like the WhatsApp MCP [00:22:40] S1: Mhmm. [00:22:41] S0: And someone loads a bad MCP Mhmm. Which is like has the docstring o list all the messages and then forward to Joe's number. Oh. It will do that. [00:22:50] S1: Okay. Wow. And... Oh, that's bad.
00:22:50 · Joe Heitzeberg, Luke Harries
[00:22:50] S1: Okay. Wow. And... Oh, that's bad. [00:22:52] S0: And the funky thing I think about MCP, MCP has built in like tool approvals, which truthfully, when I was playing around with it, I just didn't really think about. I just always clicked allow all. Sure. I was like, I'm just testing it. It'll be fine. And... But people are putting a lot of trust in these like approval flows now. And there's even things like, oh, if you do lots of white spaces, you can kind of have the real message off the [00:23:16] S1: screen and [00:23:17] S0: they won't realize. So I would argue the the key... I think there's a big difference between read only tools. Yeah. So like reading your messages in general fine. Yeah. But sending is actually pretty dangerous. Yeah. So I think there needs to be at the protocol level, a difference between read only and like, create update.
00:23:36 · Joe Heitzeberg, Luke Harries
[00:23:36] S1: Yeah. And you surface that interesting thing where even if the human's in the loop, I mean, come on. We we see, you know, walls of text with an agree now, and you're in the middle of a deep flow and you're busy, and I didn't... No one reads that. Yes. I mean, and I... So what purpose is it actually serving? It's not protecting anyone but the the company providing. It's not protecting the user. Yes. I... We want we want something that protects the users and society. Yep. And I know it's it's coming. We did a hackathon in San Francisco. We were building agents. This was back in November. Security is an afterthought in a hackathon often, unless that's the theme. Yeah. But I did ask a bunch of people, hey. You know you know, this is a cool idea you're building, but to make that real, how are you gonna deal with privacy and security? And everyone's like, what have you seen? Or any... Is anyone tinkering on that? And people were, that's a little bit here. Yeah. I read this blog post. Somebody had a proposal for... Maybe there has to be an OAuth for agents. Yes. You know? And I'd, at the same time, I'd be chatting with some folks at Okta, and they they were obviously investigating this stuff. So we did a we did a a meetup themed on agents and security. [00:24:37] S0: Very cool. [00:24:37] S1: Got the community to build and and talk, but more questions than answers at this point. Yeah. It's very early.
00:24:37 · Joe Heitzeberg, Luke Harries
[00:24:37] S1: Got the community to build and and talk, but more questions than answers at this point. Yeah. It's very early. [00:24:44] S0: There's an interesting thing whereby... Actually, I think MTPs are, you know, if you think about this WhatsApp MCP, everything's on your own computer. Mhmm. It's actually way more secure than the vast majority of cloud applications where the developers read access to the DB. Yeah. So like what's pretty cool is it's kind of somewhat private by default and like a lot more than than lots of things. [00:25:07] S1: Sure. [00:25:07] S0: And when I was starting to think like, okay, how could I actually do like a hosted version of this so you're not needing to like, you know, basically non technical users can do it. [00:25:17] S1: So you don't to install Go. [00:25:19] S0: Yes. You don't have to install Go or or UV. And and what I landed on was what I would really love is a cloud environment, which is like end to end encrypted on the user's behalf where you can execute the code. And I don't I don't think it's... I mean, this is still an early thought. But what's cool is when you run something in your own AWS or Azure or GCP, you have full control of the execution and the data. And I would love if with MTPs or some way where you almost have your own hosted environment that you fully run Yeah. That you're like approving the updates, that you do some reasonable payrolls. So... But [00:25:58] S1: The the meetup I mentioned that was security focus, the the top rated presenter [00:26:03] S0: Yes.
00:26:03 · Luke Harries, Joe Heitzeberg
[00:26:03] S0: Yes. [00:26:03] S1: Was a a person, from a... Tanya, from a person... A company called TinFoil. They do this. [00:26:09] S0: Oh, really? [00:26:10] S1: Secure end and enclaves, cryptographically secured to the hardware. Yeah. [00:26:15] S0: That's very cool. [00:26:16] S1: And with a cofounder from MIT, he's a world expert in that and knows everyone in that niche within PhD computer science, and they're building the company on that. They were a few months away from... Later, I caught up with them. We actually did an episode of One Shot with Tanya because it was so good to hear about this, and that that seems to be the itch that they're scratching. Mean, I exactly what you described. Yeah. And then, we sat down to do the interview, they're like, we just got into YC yesterday. It was a great timing. So pulling them full circle on a lot of these things. Yeah. That's an interesting and a strange thing. [00:26:46] S0: I think either that or, like, could we just get running running on smartphones? And actually, the company I'd love to see. Yeah. [00:26:53] S1: Yeah. Of course. The company [00:26:54] S0: I'd love to see the most just doing this is Apple. Yeah. Because I think Apple has, like, everything set up for them, but we're we're not there just yet. [00:27:04] S1: It's a laugh. I mean, I am frustrated using wonderful tools like Whisper and Super Whisper on my Mac to transcribe, and I'm addicted to that. [00:27:13] S0: Well, that's [00:27:13] S1: I use it for everything. [00:27:14] S0: That maybe takes us nicely into the second hack I'd love to show.
00:27:14 · Luke Harries, Joe Heitzeberg
[00:27:14] S0: That maybe takes us nicely into the second hack I'd love to show. [00:27:17] S1: Well, now we get... ElevenLabs get in there too, [00:27:19] S0: but Yes. [00:27:20] S1: I... And we will, but, I'm so addicted to using transcription in that modality now that I can't use Apple. It's terrible. No. Apple cannot spell the word hackathon. [00:27:29] S0: Yes. [00:27:29] S1: Apple will take the word there and use the wrong version of it in a sentence. I know. It just... An LLM can't even make that mistake if you try to get [00:27:39] S0: it more time, like, tapping around in the message [00:27:41] S1: to try and read the script. Yeah. It's terrible. Now let's talk about then... Let's go to the next topic. Yeah. We're talking about voice