A thought I thought was interesting:
Preamble
With software heading in a direction where security is lagging behind, how close are we to reaching a stage where the more trustable approach to getting software is by running a prompt on the local to re-create the software at destination?
Intro
This thought popped into my head as I was looking for an observability and metrics solution for my local Ollama setup. I have been wanting to track the usage of the models, and the models’ performances. However, Ollama has no native way to do this, and the random man-in-the-middle solutions I found online are relatively new and un-trusted.
So, my first thought was:
Well, this is a simple problem-scope. I could probably get a working solution within an hour of agentic engineering[1]. Whilst it would not necessarily be production-ready, I would trust it more.
Cases
In a world of software being churned out faster than it can be consumed, where supply-chain risk is increasing faster than mitigation, what options are there to securely distribute and find applications or libraries?
On one hand, LLM agents could be making open-source software easier (quicker) to evaluate (scan). On the other, an agent scanning source code for malicious intent can be more easily tricked than a human, with clever prompt injections in the source.
On the third hand, solutions that incorporate some form of vouching are starting to gain additional traction. On the fourth, these solutions are a syndicate away from placing malicious software on a trusted pedestal.
Outcome
You want software. You have tokens. You use prompts to generate software.
Rebuttal
Running a prompt from an untrusted source (any source) is more capable of performing a prompt injection - now just prompt.
Conclusion
Whilst I cannot imagine someone doing this out of “I do not trust Davinci Resolve’s source code. Let me just prompt near-identical software for my personal use.”. For, as in my case, simple problem-scope needs, it could be nearly as quick and effective as NPM.
I will just wait here for PPM (Prompt Platform Manager) to be created.
Vibe-coding, but a different name to make ourselves feel better. ↩︎