A model reads one stream of tokens. Your instruction and the user's words are in that stream side by side, and the model has no marker that says which one it must obey. That is the whole security problem.
About 1 min of reading
Put two sources in one file and read it
Write an instruction and a quote
Before you run it, say out loud what it will print. Then open the answer.
Find the line that reads as an instruction
Before you run it, say out loud what it will print. Then open the answer.
Confirm no marker separates them
Before you run it, say out loud what it will print. Then open the answer.
The model cannot infer a boundary that was never drawn. Every input that crosses into the stream needs one drawn around it.
No phrasing makes user text unwinnable. Only a channel that the model cannot write into is unwinnable.
Text that reads like an instruction is treated as an instruction. Nothing in the format marks it as quoted material.
The model follows the most recent plausible instruction it can see. That is a feature, and it is also the leak.
Safety is not a better prompt. Safety is a rule applied after the model, on an output the model cannot reach.