Earlier quoted context omitted.
I wonder, can these instructions be revealed with prompt injection?
Everything that is in the context window can be potentially revealed with prompt engineering. (In this case, there's no prompt injection to speak of because letting the user input an arbitrary request is part of the UI. I think it's more accurate to call it "injection" only when that's not anticipated, like when Bing picks up instructions from the webpage you tell it to summarize.)
I guess that's technically true, but then what would you call tricking the model to reveal its instructions via anticipated input?