Agreed. But it's also worth pointing out that the privacy and security issue isn't really fixable. Mitigations with separate agents to interact with private data and untrusted data can help (what vira does, what I'm doing too) but they still have to talk to each other. From an information theoretic perspective you can't stop prompt injection and data exfil, you can only make it harder.