i think the mitigation steps will be as though you had a less than trustworthy third party contact center employee answering on the other side of the chat - need to detect no-no words, sanitize url’s, observe and set limits and budgets and alerts for unusual behavior.

until these language models have symbolic reasoning i dont think we can reasonably expect to solve these within their paradigm