I wonder if you can coerce llm email autoresponders into revealing api keys or summat.
@munin Generally the tool calls are totally isolated from the text context so it's pretty unlikely. Then again if they use RAG yoy might be able to get it to fetch sensitive data if it exists in a connected database
well that's the thing - if they've hooked it up to have access to the email corpus in order to generate replies, that means the training data's potentially got some interesting shit in it.
