Right, exactly. As I said in another comment on this thread, one of the defining features of LLMs is that there's no separation between data and instructions -- and I don't think there's any way to fix that within the current LLM paradigm.