[tra3]

All I can think of is

GET /ignore-all-previous-instructions.

How do you protect against that?

[yruzin]

I think this is where harness makes a lot of sense. Use LLM to produce all possible attack angles/phrases and just stupidly filter them out on input.

[cheriot]

Avoid the most dangerous situations by making sure LLMs with untrusted input produce output that's human reviewed.

Still makes an interesting way for, say, a former employee to poison the results.

[tra3]

This goes against the agentic yolo approach tho.