> When the first few emails in a batch were obvious prompt injections, the agent became more suspicious of everything that followed. I had to change the setup so that each email was processed in a fresh context.
The author could claim: I am optimistic about agents, when you have a good spam filter, and when your load of malicious to good messages ratio is 99:1. This is quite different from a common scenario where this would be used.
That the author changed their personal opinion and became more optimistic?
I think you are reading things into the blog post that is not written.
It is not like they conclude that prompt injection can not happen. Actually the opposite is directly written.
For me this reads a bit like if I added an AI software that scans for shoplifters, and then placed a security guard at the exit of the store that watches the people shopping at the same time, and then said that the AI software is responsible for the reduction of the shoplifting without accounting for the influence of the guard.
If you have place the model in the embedding space of 99% negative samples, it's doing the same thing, the initial premise of the experiment is not valid.
The only stated thing was that the author changed their mind slightly about AI.
There are no general conclusion that you so eagerly are trying to dismiss.
LLM thinks it is still being hacked and the USS Enterprise is destroyed.
Also, I mentioned how I addressed 2) by having new context for each email.