I've written a bunch about this:

- Prompt injection: What’s the worst that can happen? https://simonwillison.net/2023/Apr/14/worst-that-can-happen/

- The Dual LLM pattern for building AI assistants that can resist prompt injection https://simonwillison.net/2023/Apr/25/dual-llm-pattern/

- Prompt injection explained, November 2023 edition https://simonwillison.net/2023/Nov/27/prompt-injection-expla...

More here: https://simonwillison.net/series/prompt-injection/