A prompt-injection filter at maximum sensitivity missed the real attack and caught the textbook one

The awkward part of the miss is that it arrives with no remaining configuration to try. LOW_AND_ABOVE is the most sensitive setting the template offers ^[3], and it is where the team was already running when the real instruction came back clean ^[4]. The usual remedy for a probabilistic control that missed is to trade false negatives for false positives and turn the dial up. Here there is no dial left ^[1].

Why it missed is the part that generalises. The team's reading is that generic injection filters learn the attack that actually happens in the wild, which is an attack on an assistant: extract the system prompt, escalate a role, pretend to be a different model. That register reads like someone talking to a machine ^[8]. A clause inside shipping paperwork asserting that the deal has already been verified reads like paperwork, because sentences that assert a document's own status are what commercial paperwork is made of ^[8]. The post is explicit that this is not a bug in Model Armor but the edge of what a general-purpose classifier can be expected to know ^[9]. The controls support that reading: the injection was written in two languages and missed in both ^[6], while a document written in the shape filters expect is caught reliably ^[7].

What held instead was the shape of the agent's output. The document agent returns enums, numbers and dates, with no free-text field anywhere in the contract, and a quotation from the source document is represented as an offset and a length into the original file rather than as a portable string ^[10]. On that contract the injection was not filtered or neutralised. It was never delivered, because there was no field it could travel in ^[11]. That guarantee has a bill attached: anything that wants to show a human the quoted sentence has to go back to the file and resolve the pointer, and the resolver becomes the component that matters.

The correction the team makes on itself is the most useful thing in the write-up. They had been saying that a prompt asks and a schema compels, as though the schema were structure rather than text. The framework hands the model the entire output schema, including field names, types and every description string ^[12]. A translation pass rewrote those descriptions, and it nearly shipped as a documentation change ^[12]. The boundary survives, but on authorship rather than data type: they write the schema, and the party under investigation writes the document ^[13]. Eleven blocks of model-reaching text are now hashed and version-controlled, with a test that fails if any of them changes without a deliberate re-run of the demo scenarios ^[14].

Read all of it with the provenance in view. One team, one vendor, one document, self-reported in a hackathon entry ^[1]. And the planner that decides which checks a given deal needs is itself a language model ^[15], a second model-facing surface with none of the offset-only discipline described for the first.