> Secondly, CPUs can absolutely be used to hack other people.
This is more correctly phrased as "Every general-purpose computer can be run any arbitrary program, assuming it has the storage required to load that program.". Despite that fact, we've managed to learn how to write programs that run on those computers that fail to give attackers who have control of the inputs to those programs control of the instructions those programs feed to the CPU. This part of your argument strengthens my point.
> First and most importantly, the set of behaviors of a CPU is extremely constrained...
The techniques we use to prevent data our programs process from altering the instructions we send along to our CPUs work regardless of instruction set complexity. This objection of yours is irrelevant.
A CPU does not know who authored the next instruction it is to run. A CPU only knows to execute instructions handed to it. Despite the fact that CPUs are dumb as bricks and have zero understanding of where their instructions come from, we've -somehow- managed to learn how to build software that operates on untrusted data without relinquishing control of the CPU's instruction stream to attackers.
The LLM providers ignored the most basic lesson of the last ~fifty years of secure software design. This was economically a very smart thing to do, but an absolute catastrophe for the health of computing.
As you correctly mention, the CPU providers aren't the ones who are responsible for the scaffolding that ensures security in programs. The CPU cannot decide if an instruction is safe or not, and the same is true of LLMs. Think about SQL injection - we did not change SQL the language, but how we utilize it in backends.
A lot of people (thousands) outside of the LLM providers work on the problem of Prompt Injection, both in industry and academia. We aren't even at a point where we can reliably detect it, let alone prevent it. Please, if you have a mental model of how scaffolding around things like instruction or SQL injection could be used for LLMs, I'd like to move on to all the other (less pressing) security issues we have because of the AI revolution.
This is more correctly phrased as "Every general-purpose computer can be run any arbitrary program, assuming it has the storage required to load that program.". Despite that fact, we've managed to learn how to write programs that run on those computers that fail to give attackers who have control of the inputs to those programs control of the instructions those programs feed to the CPU. This part of your argument strengthens my point.
> First and most importantly, the set of behaviors of a CPU is extremely constrained...
The techniques we use to prevent data our programs process from altering the instructions we send along to our CPUs work regardless of instruction set complexity. This objection of yours is irrelevant.
A CPU does not know who authored the next instruction it is to run. A CPU only knows to execute instructions handed to it. Despite the fact that CPUs are dumb as bricks and have zero understanding of where their instructions come from, we've -somehow- managed to learn how to build software that operates on untrusted data without relinquishing control of the CPU's instruction stream to attackers.
The LLM providers ignored the most basic lesson of the last ~fifty years of secure software design. This was economically a very smart thing to do, but an absolute catastrophe for the health of computing.