Skip to main content

Tools and safety

The assistant can use tools. Some tools read your private data, for example your email or your documents. Some tools send data out, for example a tool that sends an email or loads a web page.

Text from email, documents, and web pages is not trusted. This text can contain instructions that try to make the assistant act against you. This attack is called "prompt injection". Telosnex limits the damage in four ways.

1. Each tool has a mode​

Each tool has a mode: off, ask, or auto.

  • In off mode, the assistant cannot use the tool.
  • In ask mode, the app stops before the tool runs. It shows the tool and its inputs. You approve or deny that one call.
  • In auto mode, the tool runs without a stop.

Google tools that write, send, share, or delete start in ask mode. You can change the mode of one tool at a time.

2. The app warns about the "lethal trifecta"​

A risk exists when the tools that are on can do all three of these things:

  • read your private data
  • read text that is not trusted
  • send data out

When you turn on a tool that makes all three true, the app shows a warning. The warning lists each tool that can send data out, and it sets those tools to ask mode by default.

3. A denial is final for that call​

When you deny a call, the assistant gets a fixed message. The message tells the assistant not to try the call again, and not to get the same result with another tool.

4. The app can check tool calls for prompt injection​

When this protection is on, a model on your device checks the inputs of each tool call before the tool runs. It also checks the result before the assistant gets it. The text does not leave your device for this check.

When the check finds a possible injection, the app stops. It shows the part of the text that looks like an injection, and its score. You decide if the tool runs, or if the assistant gets the result. If you deny, the assistant gets a fixed message and not the text.

If the check cannot run, the app also stops and asks you. When no one can answer, for example in a voice session, the tool does not run, or the assistant does not get the result.

By default, the check skips the tools that read your own files and the tools that run commands on your computer, because these checks are slow. The setting Also check files and commands adds them.

To turn it on, open AI Controls, then Prompt Injection. Download Wolf Defender, the model that does the check. Then turn on Check tool calls.