Because again, it's really just the inference cost that ends up mattering. That's the first part. And then the second part for Anthropic specifically, let's say, is I actually just believe that they consider this to be a major safety risk. So to them, they're not like thinking about this. I'm guessing they're not thinking about this as like an economic, you know, argument that they should be open source for market share reasons. I actually just think that they fundamentally believe, no, you actually need one entity to control the flow of the tokens to be able to do, you know, kind of prevent, you know, prompt injection and make sure that you can route to different models based on the kinds of queries people are doing.

In particular, previous work has identified the absence of an intrinsic separation between instructions and data as a root cause for the success of prompt injection attacks. So, again, the main concept that I want everyone to understand is that this is an inherent problem of large language models. That is, they aren't programmable in the way that computers are programmable. They're made with computers that are programmable, but that isn't the way they function. And the magic is that it isn't the way they function. So, after last week's deep dive into exactly this problem, none of those statements about the fundamental problems of LLM differentiating commands from data should be surprising.