We keep on having to relearn this principle over and over again: mixing instructions and data on the same channel leads to disaster. For example, phone phreaking were people were able to whistle into the phone and place long distance calls. SQL injection attacks. Buffer overflow code injections. And now LLM prompt injections.

We will probably end up with the equivalent of prepared LLM statements like we have for SQL that will separate out the instruction and data channels.