A fundamental flaw leaves LLMs vulnerable to attack

“There’s a real probability that this is going to be a problem that’s fundamentally unsolvable.”

Models sort instructions by writing style, not by any hard boundary, so forging the reasoning voice gets you straight through. The ICML paper found it in models from OpenAI, Anthropic, Alibaba and DeepSeek, which makes it architecture rather than a bug ticket. Every vendor shipping agents with tool access and payment credentials has known about prompt injection for two years. They shipped regardless.