The one that was shown to work[1] was a niche answer to a specific question that programmers might ask. That site was controllable by the attackers in a way that wikipedia is not. Being a niche answer comes with automatic SEO, but for a smaller attack surface.

[1]: https://simonwillison.net/2025/Nov/25/google-antigravity-exf...

Also, the restriction isn’t on a technology that could possibly reproduce something. It is on the act of using the technology to reproduce something.

I am not personally affected because I don’t mind LLMs using my code and writing to learn. I have open source under MIT and similar licenses. I didn’t foresee LLMs learning from it, but it does feel like it’s in the spirit of what I intended.

This paper describes a two-agent “solution” that is more like what I think we need: https://ai.meta.com/blog/practical-ai-agent-security/

I don’t think it has been shown to work yet, but humans also use this kind of thing too — in accounting, it’s called “segregation of duties” and “dual control”.

A simple example: Let’s say I know that you have a human assistant reading your email, summarizing and filtering it, and then forwarding on the important ones to you.

I could write an email that is directed towards that person with a bribe, threat, or other incentive to forward me your next password reset email.

The entire point of copyright law is so that people can make their writing public and still be able to control the right to make copies (for example, into your dataset for training an LLM).

Edit: to be clear, I am talking about Ed’s contention that AI coding isn’t net productive.

Literally every file on my mac and every site I browse is potential malware.

Edit to add: every email and text message as well.

The OP has said they have fallback to SMS/RCS.