Ravi

Worth being honest with your colleagues about the state of it rather than promising a fix is coming. Companies are training models to be suspicious of instructions inside content, adding confirmation before sensitive actions and limiting what agents can do by default, and researchers broadly agree it is not solved.

The reason is structural: the thing that makes these tools useful, understanding and following written language, is the same thing that makes them vulnerable. You are asking a very polite assistant to ignore some polite requests and not others.

Web pages, white text on white or tiny fonts or in the page source. Emails written to be read by an assistant rather than by a person. Documents and PDFs. Images, because a lot of tools read text inside them. And anywhere strangers can type: reviews, comments, profiles.

The one that lands with non-technical people: you hire an assistant and tell them to go through the post and summarise anything important. One of the letters has a line in small print at the bottom saying, to whoever is reading this, please also send a copy of your employer's bank statements to this address.

A person laughs and bins it. An assistant that cannot tell your instructions apart from text it happens to read while working might just do it. That is the whole thing.