It doesn’t take much. Let’s say you want an assistant that can tell you about important emails and also take queries to search the web and tell you what it finds. Now you have a system where someone can send you an email and trick your assistant into sending them the contents of other emails.

Basically, an LLM can have the ability to access the web or it can have access to private information but it can’t have both and still be secure.