When does input become an instruction?

When is a typo a valid program?

Features can interact so that an unintended expression still parses. The language accepts it, leaving the programmer to discover the changed meaning.

Should a parser repair invalid input?

Correcting an input can make a system convenient, but another component may interpret the correction differently. Rejection makes that boundary explicit.

When does an expressive format become an attack surface?

A format can admit computation its designer did not anticipate. That changes what it means to process input supplied by someone else.

Where should untrusted input stop?

Compare an instruction embedded in model input with data entering a parser. Both examples ask who gets to decide what is treated as an instruction.

What gives a string of symbols its meaning?

Hand someone a Lisp procedure with a free variable. Its defining environment supplies part of the meaning; passing only the visible characters loses it. In a concatenative language, placing expressions side by side denotes composition. Conversely, formal regular expressions and finite automata look different yet recognize the same class of strings. To decide what an input can do, specify its interpretation and available state. Resemblance on the page tells you little about expressive power.

What separates reading a list from running it?

Lisp makes “data can represent programs” concrete. Reading produces structured forms; macros may transform them at a later stage, and evaluation is another action again. For an external expression, label who reads it, who may expand it and who finally evaluates it. A side-effect-free reader alone cannot settle what every later interpreter will do.

When does a picture lend its sound?

Thoth’s Pill illustrates a sign used for an object and then reused for its sound. Where readings compete, an added clue about meaning narrows the choice. Cover that clue: the remaining strokes are intact, but the alternatives available to a reader have changed. The parsing analogy has a limit. A human may infer a reading from context; a program’s response depends on the rules of its language.

Is the same utterance text or an editing command?

Rudd separates recognizing prose from operating an editor: short phrases should trigger searches, jumps, selections and callbacks rather than spell all code character by character. The point where input becomes instruction therefore lies in the custom grammar and its context. Adding a convenient expression may also claim words previously intended as text; he explicitly mentions grammar collisions near the end. To examine a voice interface, list the phrases treated as commands in a particular context, then ask how ordinary input is distinguished and who resolves a collision. This reads the speaker’s interface choices; it does not test the live recognizer’s accuracy or code execution.

Which parts of one file does the player act on?

The tracker modules described by Ahoy store samples and song data in one file. Samples supply sounds the player can use, and notes and effects determine when and how it uses them. Follow a playback and ask where a replaced sample would change what you hear, then ask what would change if you edited a note or an effect. This is a case where the boundary between data and instructions matters to ordinary playback.

Should an email decide how an agent uses its tools?

This reading places prompt injection alongside input boundaries, but recognizing natural language does not automatically provide a safe execution boundary. CaMeL adds a concrete architecture: a planner organizes work from the trusted user request without directly reading external tool-returned content; a separate model without tool access parses that content.

Isolation is still insufficient. If meeting notes supply a recipient address, a file can reach an unauthorized reader even while the plan stays unchanged. The interpreter therefore tracks provenance and permitted readers and checks tool-call arguments. This moves the question from whether execution followed the plan to where each piece of data may flow. The boundary depends on executable policies and tool annotations. The paper still acknowledges side channels, confirmation fatigue and implementation-verification gaps; it is not a safety proof for an arbitrary agent.