@david_chisnall for folks who want a bit more technical knowledge as to why exactly this is the case, https://role-confusion.github.io/ is some pretty good reading.

It turns out that using the LLM itself to try to distinguish between "prompts", "user input", "internal thoughts", "tool output" ends up training it more to match on the different writing styles used in these different functions rather than the tokens/tags used as delimiters.