This is why LLMs should not be used as AI agents. They suck at following simple instructions AND stopping there.
What we need is dedicated translators that turn your instructions into executable code - an AI scripting language, if you will - and use limited language models to process text based on those instructions.
By mixing “code” (instructions) and “data” (text to read / analyze) into these models’ training, prompt injection was just waiting to happen.
OpenAI and friends are just repeating Microsoft’s mistakes. Remember MS Word viruses? Exactly the same thing.
Sigh
Why would you use your AI Agents to check emails? I only use my locally run AI Agents to send me incredibly insulting messages on Matrix and Signal because I’m into that kinda thing.
Unless you go in and specifically turn them off they are on by default in some email systems like Google’s (and I think Microsoft’s).
Why use AI to read emails? My rules are that if in Inbox and unread for a week, move to Purgatory. If in Purgatory for more than a month, delete.
If you want me to read an email, you better text me that you emailed me. Receipts, updates, and all that jazz already have filters and rules.
Bro, if you ever text me and expect me to read it, call me.
If you call me, something very important better be on fire. (Assuming we’re still talking work)
I need to step up the names for my filters I see. Any and all meetings immediately go to Kokytos. Weredog pamphlets? Elysion.
Yeah no shit, 20 years of gmails ‘s complete inability to determine spam from real email is testament to this
That’s a very interesting take. Gmail has always had one of the better spam filters in my experience. I absolutely remember when common wisdom was that if you were inundated with spam, one way to help was to forward email to a gmail box and have its spam filters run on it.
Even today, I see very few false positives and false negatives.
YMMV of course.
It turns out that making a machine that is capable of determining the difference between actual legitimate messages and messages pretending to be legitimate is a really difficult problem to solve
In no small part because of adversarial training.
Well we are also trusting an advertising company to filter out ads.
they have an interest in filtering out ads they weren’t paid for tho
Considering that most of the difference between “wanted” and “unwanted” content depends entirely on the user, I’m surprised systems like these even work as well as they do.
We spent decades teaching people not to click suspicious links, then handed our inboxes and payment permissions to a chatbot that treats »ignore previous instructions« as a promotion to management. The phishing email no longer needs to fool you: It just needs to fool your very expensive autocomplete intern.
