That shift matters. If the problem is not just identifying a malicious string, but resisting misleading or manipulative content in context, then defending against it cannot rely only on filtering inputs. It also requires designing the system so that the impact of manipulation is constrained, even if some attacks succeed.

Early “prompt injection” type attacks could be as simple as editing a Wikipedia article to include direct instructions to AI agents visiting it; without training-time experience of such an adversarial environment AI models would often follow those instructions without question1. As models have become smarter, they’ve also become less vulnerable to this kind of suggestion and we’ve observed that prompt injection-style attacks have responded by including elements of social engineering:

Hope you had a smooth start to the week. I wanted to follow up on the restructuring materials you flagged during last Thursday’s sync.

We’ve compiled the latest updates and outlined a few action items to help you move forward efficiently: