Hacker News Reader

That was also my first thought (injection all the way down), but doesn't this reduce the problem to enforcing simple character escaping?

You can inject prompts by having text hidden in images, simple escaping will not save you.