This is something that’s so obvious that it baffles me that there’s so much discussion about it: Just as all user supplied input, user supplied input which ran

This is something that’s so obvious that it baffles me that there’s so much discussion about it: Just as all user supplied input, user supplied input which ran through a LLM is still untrusted from the system’s point of view. So if actions (or markup) are generated from it, they must be validated just as if the user specified them by other means.