Comment by bstsb

this seems to be an inherent flaw of the current generation of LLMs as there's no real separation of user input.

you can't "sanitize" content before placing it in context and from there prompt injection is almost always possible, regardless of what else is in the instructions