But bugs like this aren't because natural language is ambiguous, it's because the LLM/etc has inadequate safeguards against unambiguously malicious text. If LLMs were capable of understanding human language and only subject to natural linguistic ambiguities like any other college-educated humans, bugs like this wouldn't be reliably reproducible across different models. People in this thread are trying very hard to argue that humans are subject to this via social engineering but it is not the same. GPT-5.6 is subject to this bug for the same reason it sometimes rm-rfs stuff it "knows" it shouldn't: these machines are still stochastic parrots. It is borderline magical how powerful stochastic parroting is as a means of computation, but in the same way that a minimal Lisp system can magically be extended to a powerful theorem-proving algebra-cruncher. But parroting is simply not how humans actually understand language, and it is clearly an inadequate way of implementing language on a computer.

I'm just wondering if a reading pipeline could include converting documents being consulted to plain text. Then malicious sections imported to a document being edited would be obvious to human(s) involved as they would no longer be in 8pt white font on white background.