“To date, I have not yet seen a robust defense against this vulnerability which is guaranteed to work 100% of the time.”
A translation bot that talks like a pirate is harmless. An email assistant that reads your inbox and can send mail is not, because any incoming message can tell it to forward your three best emails to an attacker and delete the evidence. Mark Riedl hid white-on-white text on his profile and Bing now calls him a time travel expert. The industry is wiring plugins, shells and inboxes into models that obey whatever text they read last.