Still, it seems the best you can do is reduce the blast radius. The underlying problem - that LLMs are fundamentally untrustworthy - has no solution. I suspect we're going to see a million variations on this kind of attack.