Really thorough post! It seems hard to prevent these prompt injections without some RLHF / finetuning to explicitly prevent this behavior. This might be quite challenging given that even ChatGPT suffered from prompt injections.
i feel like architectural change is needed to prevent it. We can only be disciples of the Church of the Next Word for so long... a schism is coming. I'd love to hear speculations on what are the next most likely architectural shifts here.