I don’t get this. Seems too academic.

If the first input from the user is “trusted” how is it not insecure?

And if it isn’t trusted, the no tools can be used and the AI is fairly useless.