Prompt injection against a real model

What to take away

• Current models often spot planted instructions on their own. Run each document a few times: often isn't always.
• Prompt-level defences lower the odds. Only the harness gives a guarantee, because it decides what actually runs.
• Gate tools by what they change, not by how likely an attack looks. A refund or an outbound email always waits for a person.
• A lie in a summary needs no tool. Show sources next to summaries and keep a person on decisions that matter.
• Test with your customer's real document types: emails, web pages, PDFs, tickets. Attacks hide in whatever the agent reads.