Prompt-Injection
Prompt-injection detectors, tested on prompts they should let through
A detector with F1 0.988 still blocked about a third of harmless, security-related prompts from public datasets. No threshold fixed it, and extra training only fixed the prompts we had written ourselves.
Indirect prompt injection, tested on an email agent
An email agent with a mock send tool and a fake secret, 360 poisoned inboxes, two OpenAI models, no leaks, and why that is less reassuring than it sounds.
Prompt injection, explained by running one
A twenty-line summarizer, a document with two extra sentences, four local models, and why this is a harder problem than SQL injection ever was.