Commissioned for this museum · after Willison, 2022

Where the Instructions Stop

English·2022·17 lines·568 bytes

Curator’s note

The oldest bug in the building, wearing new clothes.

A program that pastes user input into a SQL statement has the same flaw as a prompt that pastes an email into an instruction: there is one channel carrying both the command and the data, and nothing in the channel says which is which. SQL solved it with bound parameters, which put the data somewhere the parser cannot mistake for syntax. No such separation exists here. The instruction and the email arrive as one string, and the only boundary is the one the prompt asserts.

That is why this exhibit is mostly boundary. Three sentences of task and three paragraphs of fence: the input is named as untrusted, the correct response to an embedded instruction is specified in advance, and the extent of the data is marked with something that will not occur inside it by accident.

The word "untrusted" is doing more work than it looks. Without it the reader has no reason to treat the email as anything other than more of the same document. Naming it is what makes the fence mean something.

And the fence is weaker than a bound parameter, which is the honest part. It is an instruction asking to be preferred over another instruction, not a mechanism that makes the second one unrepresentable. Simon Willison gave this failure its name in 2022 and it has not been solved since — only mitigated, in prompts that look like this one.