Every published prompt-injection defense gets bypassed above 90% under adaptive attack.

A joint study across OpenAI, Anthropic, and Google DeepMind found no single filter or classifier holds up against an adaptive attacker. (Help Net Security) Treat injection as a containment problem, not a detection one: separate trusted from untrusted text, validate output structure before acting, sandbox capabilities, enforce least-authority tools, plant canary tokens, and gate high-impact actions on human approval. There's no magic filter coming. Design for defense-in-depth or accept the breach.