I don't think that's a robust solution, sadly: https://simonwillison.net/2022/Sep/17/prompt-injection-more-...