But how can you sanitize text? That's what makes this stuff hard: the previous lessons we have …

Interesting! But, in the CaMel proposal example, what prevents malicious instructions in the un-trusted content returning an email address that is in the trusted contacts list, but is not the correct one? This situation is less concerning, yes, but generally, how would you prevent instructions that attempt to reduce the accuracy of parsing, for example, while not actually doing anything catastrophic

I'm not denying it's hard, I'm sure it is. I think you nailed it with this, though: > If your app has a prompt injection hole, the answer may turn out to be "your app is fundamentally insecure and cannot be built safely". Nobody wants to hear that, but it's true! Either security needs to be figured out, or the thing shouldn't be built (in a production environment, at least). There's just so many parallels between this topic and what we've collectively learned about user input over the last couple of decades that it is maddening to imagine a company simply slotting an LLM inbetween raw user input and production data and calling it a day. I haven't had a chance to read through your post there, but I do appreciate you thinking about it and posting about it!