[rowborg]

That was also my first thought (injection all the way down), but doesn't this reduce the problem to enforcing simple character escaping?

[riffraff]

You can inject prompts by having text hidden in images, simple escaping will not save you.