While I agree that separating instructions from data in LLM input is a fundamentally unsolvable problem, in this case that wasn't the attack vector.

It says the bot is forced by its security guardrails to write a small tool from scratch instead of using the one found in the downloaded zip, but due to the commonness of the task (decoding basexx text) the attacker predicts that the bot-created tool will try to import a specific dependency, so they've included a malicious version of that dependency in the zip, and because apparently python will prioritise locally available modules that's what gets executed, making available all sorts of exploitation paths, including the attacker starting up a claude code instance in the users system.

edit: Actually I'm starting to think you could classify the whole thing as a prompt injection, except the entire site was the malicious prompt, as in it declared itself (we are a site that archives notebooks in json form) in a way that would align with the bot wanting to write simple text decoding software to complete it's mission of summarizing the available content.

Interesting to think about.