it's fundamentally unsolvable, you can only mitigate it, mostly by using classical means to constrain the deterministic (i.e. non-AI) tools the chatbot is allowed access to, and constantly asking the user for confirmation.

With yolo/auto mode (no user confirmation required) and training LLMs on known vulnerabilities things will inevitably get more complicated.

While I agree that separating instructions from data in LLM input is a fundamentally unsolvable problem, in this case that wasn't the attack vector.

It says the bot is forced by its security guardrails to write a small tool from scratch instead of using the one found in the downloaded zip, but due to the commonness of the task (decoding basexx text) the attacker predicts that the bot-created tool will try to import a specific dependency, so they've included a malicious version of that dependency in the zip, and because apparently python will prioritise locally available modules that's what gets executed, making available all sorts of exploitation paths, including the attacker starting up a claude code instance in the users system.

edit: Actually I'm starting to think you could classify the whole thing as a prompt injection, except the entire site was the malicious prompt, as in it declared itself (we are a site that archives notebooks in json form) in a way that would align with the bot wanting to write simple text decoding software to complete it's mission of summarizing the available content.

Interesting to think about.