[jsheard]

> More generally, the entire concept of using middleware which communicates using the same mechanism that is also used for untrusted user input seems pretty wild to me.

That's basically the same way phone phreaking worked back in the day. Time is a flat circle.

[dontlaugh]

Somehow people never learn to avoid in-band signalling.

[wmil]

LLMs have the same problem a la "ignore previous requests".

The fundamental problem is that you always either need two signalling paths or you have to specially encode all user content so that it can never conflict with the signalling.

Those are both a pain in the ass, so people always try to figure out how to make in band signalling work.