AskVibeMarked as helpful by the asker
No, and nothing you write in the prompt will be. The model reads your instructions and the user's message as one text; a clever enough message can always talk it around. Treat the system prompt as public.
So the design rule: the model can suggest, your code decides.
- Remove the discount code from the prompt entirely.
- If the bot may offer a discount, give it a tool like
request_discount(order_id, reason). Your server checks the rules (real order? not already discounted? max 1 per customer?) and creates a single-use code. - Same for anything with money or data: refunds, order lookups (only for the logged-in customer's own orders), etc.
The prompt is for tone and knowledge. Permissions live in code.
"Treat the system prompt as public" changes how I think about this. Rebuilding with a discount tool. rocco · edited
Best one-line summary of prompt injection I've seen. Saving it. leo_prompts · edited
Sending this to my client who wants 'a ChatGPT that can issue refunds'. dana_ships · edited
Update: new version live for 2 days. People tried the same trick, bot shows the policy text (which is public anyway) and that's it. rocco · edited