 This could be avoided by: (a) eliminating excessive functionality by using a plugin that only offered mail-reading capabilities, (b) eliminating excessive permissions by authenticating to the user's email service via an OAuth session with a read-only scope, and/or (c) eliminating excessive autonomy by requiring the user to manually review and hit 'send' on every mail drafted by the LLM plugin.  Alternatively, the damage caused could be reduced by implementing rate limiting on the mail-sending interface.  Reference Links Embrace the Red: Confused Deputy Problem: https://embracethered. com/blog/ posts/2023/ chatgpt-cross-plugin-request-forgery-and-prompt-injection.  NeMo-Guardrails Interface Guidelines: https://github