Comment by jasonwcfan

If I’m understanding correctly, the technique basically injects malicious instructions in the content that is stored and retrieved?

Sounds like an easy fix, if it’s possible to detect direct prompt injection attacks then the same techniques can be applied to the data staged for retrieval.