Prompt injection cannot currently be treated as solved by model training, prompting, delimiters, or classifiers alone.

AgentDojo demonstrates successful attacks and incomplete defenses in tool-using environments.

CaMeL argues heuristic defenses lack guarantees and moves enforcement outside the model.

Bad Memory demonstrates cross-session influence from planted persistent instructions.

AgentDojo default attacks succeed in a minority of cases against its best agents.

Detectors and architecture-level controls materially reduce attack success.

CaMeL provides scoped guarantees under explicit assumptions.