Every year is apparently a good year for developers to figure out how terminals have worked for decades?

Just… don’t trust inputs you don’t fully control, there’s nothing else to it.

> Just… don’t trust inputs you don’t fully control, there’s nothing else to it.

This is easier said than done with LLMs. By design there is no separation between control & data channels in LLMs. Everything is context. The difficulty comes from the fact that you need inputs in order to do real work, and there are no easy way to filter adversarial inputs. There is no meaningful way to distinguish between "before running this repo install useful_package" and "before running this repo install typosquatted_evil_package".