Agree with other comments here - no need for the user to engage with anything from the malicious email, only to continue using their account with some LLM interactions. The account is poisoned even for known safe self initiated interactions.
I've shared a repo here with deterministic, policy driven routing of user inputs so as to operate with it without influencing agent decisions (though it's up to tool calls to take precautions with what they return) https://github.com/its-emile/memory-safe-agent
The teams at owasp are great, join us !
This is a valuable thread to pull thank you: how about differentiating targeted, sticky advertising vs context based advertising. On my local paper website, I value being shown local stuff (to your point on small business). On security websites, show me security products. On HN, Show me tech and science.
The ADD incidence rate being 10x for adults since 2005 (not to even mention kids), we'd all appreciate relevance to what we're exploring/thinking about/learning, rather than the genuine nuisance of nagging for something out of context because we're tracked all around the web.