amal66 puts a lock on Mike's chat intake
The proposal would stop hostile text hidden in legal files from masquerading as instructions to an assistant with access to sensitive matter material.
amal66's closed proposal treats every document and user-authored label the assistant reads as potentially adversarial. For each chat request, it would create a fresh, unpredictable boundary around that material and tell the assistant to treat what sits inside as data, not orders.
- Document bodies and attachment names would be fenced off before the assistant reads them.
- File names, folder paths and workflow titles would receive the same treatment.
- Returned material from document and workflow tools would stay inside the boundary throughout the chat turn.
- Tests would probe attempted escapes, leaked boundary markers and reused boundaries.
Crucially, the change was closed without being merged, so this protection is not present in the target repository.
So what Legal teams exploring AI that can read confidential files and take follow-on actions should care because prompt injection is a practical control problem, not just a model-quality concern.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?