Forget the LLM part of this completely; have two (maybe three) kinds of command: 1) Read without external forwarding (I.e. read some emails on the local LLM, o

Forget the LLM part of this completely; have two (maybe three) kinds of command: 1) Read without external forwarding (I.e. read some emails on the local LLM, only allow passing to other commands that we know are local or warn). These can be done without a warning message. 2) Read and forward externally (these give you a read out confirmation of the data you’re about to send out “you are sending 4323 emails to xyz.com/phishing” are you sure you want to continue?) 3) Write/Delete commands (you are about to delete 450000 emails, do you want to continue? Your todo-list will have 4 millions TODO items added by this command, continue anyway?). I don’t see how prompt hacking can affect these because even if the LLM is “reading” this info it would be internally in a separate context not in the main thread. What’s the problem with sandboxing the actions like this?