What is there to fix? You can't defeat these conversational exploits because this is what LLMs are. They're statistical word predictors, they must, by their design parameters, be able to accommodate anything the user says because that's how conversations work. Eventually, no matter the prompt fixing you do, the user will eventually be able to storytell their way into getting the bot to do what they want.