Everything running on LLMs can easily be dislodged with prompt injection. This is just a translator so the worst it can do is establishing a parasocial relationship with users I guess.

But over 30 years of cybersecurity go down the drain with agent based clients and operating systems and there is no fix in sight. It‘s the epitome of vaporware except big tech is actually shipping it against better judgement.