Skills
Assume every single prompt-injection defense fails under adaptive attack — design defense-in-depth, not one control
A joint study across OpenAI, Anthropic, and Google DeepMind found that under adaptive attack conditions, every published defense was bypassed at success rates above 90% — meaning no single filter or classifier is sufficient. The practical response is layered: separate trusted from untrusted text, validate output structure before acting, sandbox capabilities, enforce least-authority tools, plant canary tokens for exfiltration, and require human approval for high-impact actions. Treat prompt injection as a containment problem, not a detection problem.
↳ Follow the thread