Dual LLM: Privileged Planner, Quarantined Reader

One language model holds the tools and reads only the user's trusted request. A second language model reads the untrusted text, has no tools at all, and returns results that are stored under names such as VAR1. Ordinary code passes those names between the two, so the model that chooses actions works with labels and never sees the text behind them. This design is called the Dual LLM pattern, where LLM stands for large language model. Simon Willison proposed it, and he named the first model privileged and the second quarantined.