Every competent engineer knows you should keep commands and data separate from each other. Mixing them in a single stream is begging for problems.
But is that possible for an LLM? I suppose every input token could come with a binary flag to indicate whether it should be interpreted as a command or not. When training a model with reinforcement learning, only reward it for following commands that are marked as commands. Also include counterexamples that have commands in the data stream, and give a negative score if it follows them.
But I suspect there will always be loopholes. The commands are interpreted in the context of the data, and if you can manipulate the data, you can probably make it misinterpret the commands in the way you want. Given a sufficiently large model whose behavior is unspecified and far too complex to understand, there will always be ways to manipulate it into behaving maliciously. It's impossible to guarantee safety.
And of course, the lack of separation between commands and data is part of what makes the models useful. You ask it to do something, it doesn't know how, so it looks online for directions. If you only want it to follow instructions you specifically approve, it will be much more limited in what it can do.