Earlier quoted context omitted.
> the reality is that we are mixing instruction and data in the same context window. Absolutely. But the history of code/data confusion attacks that you alluded to in GP isn’t an apples-to-apples comparison to the code/data confusion risks that LLMs are susceptible to. Historical issues related to code/data confusion were almost entirely programmatic errors, not operational characteristics. Those need to be considere…
The LLM confusion is just the latest incarnation of the Confused Deputy problem. It's in the same class of vulnerabilities as CSRF.
The difference being that deterministic Confused Deputies can be fixed, LLMs cannot.