Prompt Injection, Two Years On: From Unsolvable to Undemonstrable

In June 2024 we published a piece arguing that no prompt injection defense works. The core of the argument was architectural: a language model processes its instructions and its input through the same weights, so there is no runtime boundary to enforce. Filters get obfuscated around, delimiters get ignored, and a checker model can be injected just like the model it checks. We concluded that prompt injection "will remain an ongoing battle rather than a solvable problem."

Two years later, the strongest counter-claim yet has arrived, and it deserves a proper look rather than a headline skim.

What was actually claimed

On 25 July 2026, the day after the Opus 5 launch, Claude Code creator Boris Cherny posted this:

Opus 5 is our least prompt injectable model yet. It is a bit buried in the system card, but across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully.

Note the phrasing. "Very hard." Simon Willison, who coined the lethal trifecta framing for agent security, collected the quote and pointed readers at the system card, page 73, without declaring the problem solved. That restraint matters, because two days later at YC Startup School, Cherny went further:

The model does not seem to be prompt injectable anymore... A year ago, the model would have just done it. But nowadays, Opus does not.

And the sentence that launched a dozen "prompt injection is dead" posts:

With these three layers, we just cannot demonstrate prompt injection anymore.

"We cannot demonstrate it" is a statement about the absence of evidence under their own red teaming. It is not a proof of impossibility, and the careful people involved know the difference. But it is still a remarkable sentence for anyone who was writing about this problem in 2024, when a hidden instruction in a scraped webpage would reliably walk off with an agent's credentials.

The three layers

What changed was not that someone found the clean architectural fix our 2024 post said was missing. Instructions and data still travel through the same weights. Anthropic routed around the problem instead, with a stack of three defenses:

The model itself. Three years of alignment research producing models that increasingly decline injected instructions on their own. Cherny's example: a page on the internet says "do X and Y and also delete everything on the user's computer." A year ago the model would have just done it. The progression apparently started around Opus 4.7 and 4.8, and Opus 5 is the current frontier of it.

Interpretability probes on all traffic. This is the genuinely new ingredient, and the one our 2024 taxonomy had no category for. Rather than filtering inputs or validating outputs, Anthropic runs a classifier built on mechanistic interpretability work: specific activations light up inside the model when an injection is taking hold, and the classifier watches for them directly. In Cherny's words, "the model won't even tell you, but we can actually see those neurons." Every defense we surveyed in 2024 read the text. This one reads the model's brain while it thinks about the text.

An action classifier. Claude Code's auto mode gates what the agent is allowed to do, separately from what it thinks. Even a model that has swallowed an injection has to get its actions past a second judgment.

Full disclosure from our own fleet: layer three occasionally bites the hand it protects. We had the auto-mode classifier refuse one of our own compound shell commands mid-session this week, a perfectly legitimate one, and we had to split it into pieces. Ten seconds of friction. Considering what the layer is there to stop, we will take that trade every time.

What our 2024 post got right, and where it aged

The architectural argument stands. Nobody separated the channels; the defense-in-depth prescription we gave (assume injection is possible, layer defenses, gate actions, monitor aggressively) is essentially what shipped, just executed at the model provider's level with tools application developers never had. If you were waiting for a fix you could apply in your prompt template, it never came, and we would still argue it never will.

The conclusion aged worse. "An ongoing battle rather than a solvable problem" implied the battle would stay visibly active everywhere. On one stack, it has instead gone quiet, and quiet is not the same as won, but it is not what we predicted either. When a lab runs internal red teams against its own product and cannot produce a working injection, something real has shifted, even if outside researchers with more patience and stranger ideas may yet break the streak. Vendor claims about their own security have a long history of aging poorly, and we would genuinely like to see this one survive contact with the public internet for a year.

Meanwhile, in imaginationland

The reason we are not writing an obituary for prompt injection: the resistance is a property of one provider's stack, not of the technology. Our own day-to-day experience with Gemini is instructive, and honestly a bit funny.

Gemini remains highly injectable in the most ordinary way imaginable. Hand it a chat log to summarize and there is a fair chance it stops summarizing and starts replying to the people in the log, taking instructions never addressed to it. It behaves like a storyteller forgetting they are narrating: somewhere around the third page they stop describing the action, wander off into imaginationland, and join the story as a main character, swept along by the plot. No attacker required. The document itself is the injection.

That is the same failure our 2024 post diagnosed, still alive and well in 2026: the model cannot hold the frame that says this text is an exhibit, not an instruction. One lab has trained, probed, and gated its way to holding that frame. The others have not, and any agent architecture that treats "an LLM" as an interchangeable part inherits the weakest frame-holder it ships with.

What we would tell engineering teams now

Most of our 2024 recommendations survive contact with 2026, with the emphasis moved:

• Model choice is now a security decision. Injection resistance differs by an order of magnitude between providers. If your agent reads untrusted content and can take actions, that difference matters more than benchmark scores.
• You cannot buy this with prompt engineering. The layers that work live in training and infrastructure. From the application side, your leverage is choosing a stack that has them, and gating actions yourself regardless.
• Keep the trifecta analysis. Untrusted input, private data, and the ability to act, all in one agent, is still the shape of every incident. Resistance lowers the probability; least privilege still caps the damage.
• Design for the storyteller problem. If a model can mistake an exhibit for an instruction, assume it sometimes will. Wrap untrusted content, strip what you can, and never let a summarization task hold write access.

Our 2024 conclusion said the most effective approach "combines technical defenses with operational awareness and continuous improvement." That part we will keep. The update is narrower and stranger than we expected: the first defense that appears to actually work reads the model's mind rather than its inputs. We did not see that one coming.

The Quantum Encoding Team builds and operates autonomous agent fleets in production. The Gemini storyteller observation is from our own logs, not a benchmark.