What Happens to Your Thumbs-Down
The trust boundary behind an agent that learns from feedback: your raw comment never enters a prompt, only a distilled sentence a model wrote from it does.
Clicking a thumbs-down on an agent response is a small, familiar action, and most products never explain what happens after you click it. Piskes's answer is worth explaining precisely, because the design takes a real risk seriously that most "we learn from feedback" copy doesn't even name.
The trap, stated plainly
Read as an attacker rather than a user, "take the user's complaint, turn it into a lesson, and put that lesson in every future system prompt" is a stored prompt injection with a quality feature's name on it. Anyone who can get flagged-as-wrong feedback into the system could, naively, plant instructions that get replayed into the agent's own prompt on every future run. Piskes's feedback pipeline is built around closing exactly that gap.
Three safeguards, and what each one actually does
Your raw comment never becomes a prompt. What you type in the feedback box is stored as-is, but it is never inserted directly into any future system prompt. It's read, not replayed.
A model writes the lesson, behind a fence. Instead, a model reads your feedback and writes a distilled sentence — the lesson — behind what the system treats as an untrusted boundary. That distilled sentence is what eventually becomes part of future context, not your original words. This matters because it puts a layer of interpretation between "text a user typed" and "text that shapes a future prompt," the same way you'd want a layer between an unverified input and a system that trusts its own configuration.
A lesson that fails an injection scan doesn't vanish — it stays visible, marked. Every generated lesson is scanned for signs of injection. If one fails that scan, it isn't silently discarded, because silent discarding would mean nobody ever finds out something got flagged. Instead, it's kept visible with a marker showing it was blocked. That's a deliberate choice to fail loud rather than fail quiet — you can see that something was caught, rather than trusting a black box that says everything's fine.
Lessons don't spread by default
A generated lesson defaults to being scoped to you, not shared across the workspace. Sharing what an agent learned from your feedback with everyone else is a separate, deliberate choice someone has to make — it isn't the automatic outcome of you clicking thumbs-down once.
Why this is worth knowing
None of this changes what a thumbs-down feels like to click — it's still one button. But knowing that your raw comment doesn't get replayed verbatim, that what does get replayed is a model-written summary held behind a trust boundary, and that anything suspicious stays visible rather than disappearing, is the difference between "we learn from feedback" as a marketing line and as something you can actually reason about the safety of.