It's hilarious how LLMs are relearning the idea that it might be a good idea to carry control signals out of band.
I guess the phone phreak generation wasn't around to say 'Maybe this is a bad idea...' (because the first thing users are going to do is try to hijack control via in band overrides)
That (prompt injection) isn’t something you can fix until you come up with a way to split prompts.
That means new types models; there is no variant on MCP that can solve it with existing models.