I log all toolcalls to a file, I think others have said the same. But I'm a bit leery of letting a hallucinating LLM write SQL queries. I think most I've spoken with, agree that an LLM is like a 20 year old, eager intern. Well meaning, but left unrestrained capable of immensely inexperienced mistakes.

Before a lot of frameworks existed, you'd see DEVs taking user input on a web form, and then just throwing it directly at the MTA. So spammers could submit email@address\nCC: persontospam@address, and the like.

Now LLMs are a different beast, but you have input validation for LLMs, unique to all other validation methods. Yet there's actually no safe way to ever validate user input for a LLM, except for very rigid input validation on single words. Take the email example above. You'd need a regex to only validate an email address (and that isn't simple), but once you expand it to actually allowing sentences?

The LLM is now input validation vulnerable.

And that means no user input can be used in unvalidated commands.

And then just random hallucinations. I'm curious how the gp managed weirdo LLM behaviour, like out of the blue 'drop table' or accidental select into as opposed to just select.