The ask-anything rework makes the security story almost trivial: two of the three Lethal Trifecta legs are absent by construction, and the third (act/communicate) was already absent. There is no retrieval, no untrusted data channel, no tool, and no destructive intent.
| Leg | Present? | Why |
|---|---|---|
| Access to private data | No | the model is given only the user’s own typed/spoken question — no notes, files, index, or other app data are read into the prompt |
| Exposure to untrusted content | No | there is no retrieval and no clipped/shared content; the only input is the first-party question |
| Ability to act / communicate externally | No | the answering session is tool-less and there is no side-effecting App Intent (the earlier delete/summarize/open intents were removed) |
With no untrusted input and no capability to actuate, there is nothing for a prompt injection to hijack — the attack the notes-RAG version had to defend against cannot arise here.
ModelHost.askInstructions) and the user’s question (in-app TextField or Siri’s
requestValueDialog). No untrusted source enters the prompt.AskGemmaIntent,
read-only (authenticationPolicy default; openAppWhenRun = false). No financial / exfil /
data-loss / navigation intent exists in the app.IntentDialog / UI). No tool writes a model string anywhere it is later re-read.IntentDonationManager donations.