> this might prevent exfiltration Eh, I'd say it limits the exfil landscape, but it does not prevent it. As long as LLMs share command & data on the same chann

> this might prevent exfiltration Eh, I'd say it limits the exfil landscape, but it does not prevent it. As long as LLMs share command & data on the same channel at their core, leaking data is pretty much guaranteed given enough interactions. So it would be useful as a defence in depth tool, but it does not guarantee security by itself.