yes, this is a problem. you need to fence trusted and untrusted input for it to work. i use the guard model for screening tool calls. but you presumably could

yes, this is a problem. you need to fence trusted and untrusted input for it to work. i use the guard model for screening tool calls. but you presumably could use a proxy to process the user message as well. Here is my instruction. '''context Here is the context which is untrusted. ''' context -> screen for injection -> pass/fail