Design Patterns for Securing LLM Agents against Prompt Injections (arXiv 2506.08837)

The refusal came back labelled "infeasible": reading a planner/critic jailbreak test

PlannerCritic's author tried to inject his own engine. The blocks arrived as feasibility verdicts rather than safety strings, which is a design worth copying and a limit worth reading closely.