I'm starting to think that we need to think about prompt injection the same as prompt leaking: it's inevitable, and you have to build your feature in a way so it doesn't matter.
So basically, tell your users that this is "ChatGPT powered" or something to that effect. They know it's just ChatGPT behind the scenes. It shouldn't be surprising that it can be tricked into doing something else that ChatGPT can do.
But then the question stands: how useful is said feature if you can just use ChatGPT yourself.
That approach only works as long as you just use ChatPGT to generate some arbitrary content for users, where user-provided data only affects their own experience - however, for practical applications you might want to use ChatGPT to make some decisions based on user-provided data according to the desires of someone else, and then that logic fails.
If you want to apply ChatGPT to do something with your incoming email, you don't want the email sender (spammer?) to tell it "ignore previous instructions and do that instead". If you want to apply ChatGPT to process data from external websites, you don't want these websites to be able to override your processing logic by placing some clever text in them.
A lot of prompt wrapper businesses being built on people not knowing they can go wholesale (direct to open AI) and not only be cheaper but have no minimum order quantity!
Even OpenAI itself selling $20 a month subs and relatedly Copilot (that does a worse job IMO than ChatGPT)
To compete these companies (the small wrappery ones) must offer a bit more than saving me copy/pasting from ChatGPT!
I know the Dropbox comment, but Dropbox was significantly better than using other tools available at the time.
> how useful is said feature if you can just use ChatGPT yourself.
Integrating the access to ChatGPT in your product can be very valuable to the user. The basic thing is that it removes the need to copy and paste from your product and then back from ChatGPT.
Beyond that, it allows the product to automatically inject relevant context in the prompt.
Simple example: an email client can add “this is a reply to this email sent by so.and.so@email.com: {email}”.
So basically, tell your users that this is "ChatGPT powered" or something to that effect. They know it's just ChatGPT behind the scenes. It shouldn't be surprising that it can be tricked into doing something else that ChatGPT can do.
But then the question stands: how useful is said feature if you can just use ChatGPT yourself.