AI in Your Inbox Can Be Tricked Via Prompt Injection, This Team Proved It. Jonathan Rodriguez Cefalu
The AI XR Podcast.Show Notes
Jonathan Rodriguez Cefalu built the hardware that Snap shipped on people's faces — first the camera-only Gen 1 Spectacles, then the Gen 4 display version. His path through Stanford CS, an honors thesis on varifocal display optics, and a startup called Vergence (named after the vergence-accommodation conflict in AR) led him to Snap, and then to the problem he is working on now. Preamble AI exists to prevent the worst possible AI outcomes — starting with a class of attack that Preamble was the first to publicly demonstrate: prompt injection.
Ted Schilowitz hosted this episode solo. Together, he and Jonathan worked through the architecture problem sitting under every AI assistant being deployed at scale right now: large language models see one token stream. There is no separation between what the developer intended and what an untrusted email or web page is quietly instructing the model to do. With Gemini Spark about to give AI agents access to tens of thousands of emails per user, this is not a theoretical concern. Jonathan's team has a proposed fix — and they have already shaped federal law.
The episode also covered the week's XR and AI news: Google I/O announcements, Snap Spectacles Gen 6 details ahead of AWE, Matthew Ball joining Xbox, Anduril's battlefield AR wearable, and AI-generated feature films reaching Tribeca.
Key Moments: [00:00] Ted opens solo — Charlie Fink and Rony Abovitz are out for the summer solstice [02:30] Google I/O: Gemini Spark and what "persistent AI agent" actually means in practice [08:15] Jonathan's Gmail test: asked to search tens of thousands of emails, it searched 30 and quit [14:40] XREAL Project Aura and the state of Android XR — a lot of spend for incremental steps [21:00] Snap Spectacles Gen 6 details: what Jonathan knows from building Gen 1 and Gen 4 from the inside [31:20] Snap vs. Meta: research that ships in the product vs. research that ships in a paper [38:45] Matthew Ball joins Xbox, Anduril EagleEyes, and battlefield AR wearables [44:10] AI on the Lot: Project Nara, Hell Grind, Dreams of Violet, Paul Schrader goes pro-AI [52:30] Jonathan introduces Preamble AI and the mission to prevent worst-case AI outcomes [58:00] The first public demonstration of prompt injection — what happened and why it matters [01:06:15] Why Gemini Spark will be especially vulnerable to prompt injection attacks [01:14:00] Preamble's proposed fix: a reserved token language that untrusted data cannot speak [01:21:30] NDAA Section 1638: the first US law making it illegal to give AI autonomous nuclear control [01:28:45] WarGames, "the only winning move is not to play," and what that means in 2026
Brought to you by Zappar and Mattercraft. Mattercraft makes spatial web experiences that run in the browser — no app required. Visit mattercraft.io to learn more and start building. Hosted on Acast. See acast.com/privacy for more information.
More from The AI XR Podcast.
Ted and Charlie open with a quieter AI news week, giving them room to dig into XR hardware, including hands-on impressions of two new smart glasses, a Norway story on camera glasses restrictions, the shutdown of the XR Association, backlash over Meta’s Muse app, and a tour through AI’s fast-moving film scene.
Charlie, Ted, and Rony open on the week's AI political theater, from the sudden rebrand of AI to "superintelligence" to Dario Amodei's uncomfortable White House appearance. From there, the conversation covers AMD's acquisition of Fei-Fei Li's World Labs, the curious divergence between OpenAI's and Anthropic's paths toward going public, and Rony's read on why liability risk may be the real story behind both. They also dig into Nvidia's push to regulate AI safety at the chip level, a stranger-than-fiction report about Anthropic bringing religious leaders in to discuss whether Claude might be conscious, OpenAI's new companion AI "Dots," and a candid look at where consumer VR actually stands right now.
Cortney Harding steps in as guest co-host this week, joining Charlie to unpack a genuinely strong Meta Connect, new occluded VR glasses aimed squarely at the Vision Pro, a camera-free Ray-Ban, and Muse AI's surprise climb to the top of the app stores. From there, the conversation turns to Disney's newly created CTO role, the quiet fate of its big-money bets on Epic Games and Sora, and Jeffrey Katzenberg's open letter arguing entertainment has always been a technology business. They close out the news with a sharp exchange on Amazon's push into drone delivery and a pointed critique of DraftKings' use of AI to target its most engaged, and most vulnerable, customers.
Charlie and Rony open with Charlie's hands-on take on Snap's $2,200 Specs launch and Rony's theory on how big tech companies let smaller players pioneer risky new hardware first. From there, the conversation turns to a tense week in AI safety, sparked by Dario Amodei's call for frontier labs to slow down, and a sharp debate over whether the industry's talk of needing regulation is really about something else entirely. They close out the news with a look at how China is approaching AI development differently than the West, plus a genuinely stunning breakthrough in brain-computer interfaces.
Recorded on the 25th anniversary of 9/11, this episode opens on a somber note: Charlie, Rony, and Ted remember where they were in 2001 and reflect on where they are now. By happenstance, Ted is actually in New York right now & is joined by the team behind GLO, a mixed-reality graffiti tour running through the streets of Manhattan on Magic Leap 2 headsets, live from their office. After a brief catch-up with friends (and a promo code waiting for you at the end of this description), the news turns dark fast. Anthropic researcher Jacob Coxon's resignation, and his warning that AI could kill us all within a decade, sparks a pointed debate about why the AI industry has no equivalent of the FAA or FDA, and why "regulate it like we regulate everything else dangerous" isn't the same as stopping innovation.