This tends to be a smell. Presumably you added "don't do this" instructions after the model started doing the thing. But that's mostly decoration, as you have found. It's like adding # Please don't crash comments to every instruction in a python program.
Try to actually debug the issue. Regularly ask "can you reconstruct[1] the reasoning why you issued that command?" ; dig down. Set traps that halt execution.
Consider checklists or skills to guide an agent through a tricky set of steps; and consider writing procedures for failures.
[1] "Reconstruct" still isn't perfect; but "explain why" is a license to hallucinate. Asking to add #comments on reasoning to each step is a potential help in reconstruction.
Got any references for the prevalence of this, even links to anecdotal reports?
Reading the reviews on the chrome store for the extension [0], I haven't found a single report of someone who was prompt injected, just a bunch of "anthropic's subscription is expensive" or "it doesn't work", but no "it stole my bank account".
[0]: https://chromewebstore.google.com/detail/claude/fcoeoabgfene...
However, Anthropic is one of the only labs who does a decent job at making models that recognize prompt injection attempts (but not completely immune) however Im speaking about giving llms in general access to your browser broadly.
I just know through my own experiments that it is quite easy to prompt inject an llm operating a browser and get it to send secrets. Using the extension might be safer idk, Om not risking it.
Llms are a security nightmare when connected to the web.
I have a website where I experiment with this. Although Ive stopped baiting llms into doing reckless things.
Killai.now <--(dont use this, its a WIP) Killai.now/poison/about Killai.now/propaganda/about
Literally never seen this once in years of extremely heavy use across all major models and harnesses.