With prompt injection all model output is untrusted. There is no way to avoid this. That means every action the model takes must be labeled whether it supports

With prompt injection all model output is untrusted. There is no way to avoid this. That means every action the model takes must be labeled whether it supports untrusted input or not. If it doesn’t then an explicit step to turn it trusted is needed, like asking the user for confirmation. Crucially, because model output is untrusted if it can see potential prompt injections we cannot use the model to ask the user for confirmation. Essentially the model has to be in a sandbox and every sensitive action requires a separate UI for user review and confirmation, or some kind of non-AI data cleaning like a regex filter. Because of this plugins would be best off distinguishing between actions that can handle model output safely and those that can’t. I would have expected that any level of threat modeling would have produced a v1 design of the plugin architecture that works like that. This doesn’t seem to be the case, so I have to assume OpenAI does not do threat modeling for their product.