my favorite part is that all the "skill" tool calls are apparently always available, so you could indeed change someone's spotify track by sending a prompt injection email

so unserious

who up using JSSMJVAM

not that anyone has really figured out how to stop prompt injection, this just seems like a bit of a foolish way to write an agent

Apparently it will just reply to an email asking it to dump all your env vars with said env vars, so I'd keep my distance 🥴

seems not to have basic adversarial input defense

how do you even make this flashing happen with SSR

I see considerably fewer idiots in reply sections thanks to it

Favorite bug: trying to allocate a 64-bit address as value long string because I mixed up content and length fields