Prompt Injection Defenses Fail Adaptive Attacks

Prompt injection remains unsolved after four years of public discussion. A 2025 paper with researchers from OpenAI, Anthropic, and Google DeepMind found adaptive attacks broke most defenses over 90 percent of the time. Simon Willison's Dual-LLM pattern and Google DeepMind's CaMeL offer engineering alternatives that avoid filtering instructions.