I have yet to see any truly credible protection for this, and I've been looking! You have to assume that anything that can get tokens into your LLM system will be able to trigger any tool that system has access to

→ View original post on X — @simonw,