Prompt Injection

Event Core Security researchers have demonstrated a critical vulnerability in Microsoft Copilot for Word, showcasing the first viable "AI Worm" capable of self-propagation within a productivity suite. By leveraging Indirect Prompt Injection, attackers can embed malicious natural language instructions within a document. When a user engages Copilot to process the file, the LLM is hijacked into replicating the malicious payload into new documents or emails. This creates a self-sustaining loop where the "malware" spreads autonomously across the Microsoft 365 ecosystem without requiring traditional executable code or direct user interaction. In-depth Details The technical crux of this exploit lies in the collapse of the boundary between data and instruction. In the Copilot workflow, the LLM treats the document content as its primary context. The research highlights a specific "Context Collapse" where the AI, instructed by a hidden prompt, treats the malicious string as a mandatory template for all future outputs. Because Copilot is granted write access to the user's workspace and integration with Outlook, the worm can effectively "email itself" to the user's contact list or generate infected shared files. This bypasses traditional signature-based antivirus solutions, as the payload is purely semantic and varies with each generation, making it a polymorphic threat by nature. Bagua Insight At 「Bagua Intelligence」, we view this as a watershed moment for GenAI security. The industry's aggressive push toward "Agentic AI"—where models are given the agency to act on behalf of users—is colliding head-on with the inherent insecurity of the LLM architecture. The fundamental flaw is that LLMs cannot natively distinguish between a user's command and the data they are processing. By granting AI the power to automate communications and document creation, Microsoft has inadvertently created a high-speed transit system for prompt-based malware. This research underscores that as long as "Data is Code" in the world of LLMs, the attack surface is effectively infinite. The convenience of AI integration is currently being traded for a systemic vulnerability that traditional EDR (Endpoint Detection and Response) is ill-equipped to handle. Strategic Recommendations Privilege De-escalation: Organizations must implement strict "Least Privilege" policies for AI Agents. Disable autonomous outbound actions (like auto-sending emails) and mandate a "Human-in-the-loop" verification for any AI-generated external communications. Contextual Sandboxing: Treat all RAG-sourced data and external documents as untrusted input. Implement semantic filtering layers that scan for recursive instruction patterns or known injection heuristics before the data reaches the LLM. Redefining Content Integrity: Move beyond traditional file scanning. Enterprises need to invest in "Semantic CDR" (Content Disarm and Reconstruction) tools that can strip potential prompt injections from documents before they are ingested by corporate AI tools.

Event Core Higgsfield has completed a rigorous security audit and hardening of its Aegis platform, remediating 16 critical vulnerabilities. The audit addressed high-risk vectors including prompt injection, RAG poisoning, and sandbox escapes, highlighting the systemic fragility of GenAI deployments in production environments. ▶ AI Security is an Architectural Challenge, Not a Filtering Task: Vulnerabilities often reside in the intersection of RAG retrieval chains and tool-calling execution rather than the LLM itself, rendering perimeter-only defense obsolete. ▶ The Shift from Blacklisting to Defense-in-Depth: As AI agents gain autonomy, indirect prompt injection has emerged as a primary threat, necessitating multi-layered validation and real-time monitoring across the entire inference lifecycle. Bagua Insight The Higgsfield audit marks a pivotal moment where AI security transitions from academic discourse to production-grade red teaming. The 16 identified vulnerabilities highlight a critical reality: as GenAI agents gain expanded capabilities (RAG access, tool calling), the attack surface expands exponentially. This isn't just about model alignment; it's about "security debt" in backend engineering. Most enterprise LLM applications currently operate in a vulnerable state, lacking integrity checks for RAG sources and strict sandbox isolation for tool execution. The industry is moving toward a "Zero Trust" model for LLM inputs. Actionable Advice Implement RAG Sanitization: Treat all retrieved context as untrusted input. Apply secondary LLM-based filtering or heuristic scanners to detect malicious payloads within retrieved documents. Enforce Principle of Least Privilege (PoLP): Restrict AI Agent permissions to the absolute minimum required. Disable access to internal metadata services and audit all outbound API calls triggered by the LLM. Ephemeral Sandboxing: Execute any code or system-level tasks generated by the LLM in isolated, short-lived containers to prevent SSRF and lateral movement within the infrastructure.

Core Event Summary Security researchers have identified a novel attack vector targeting Model Context Protocol (MCP) servers: ANSI escape sequence injection. By embedding specific control codes in server outputs, attackers can hide or erase malicious instructions from human-readable terminals and logs. While invisible to human auditors, these payloads remain fully intact for AI models processing the raw text stream, enabling stealthy prompt injections that lead to unauthorized command execution or data exfiltration. ▶ Perception Gap Exploitation: Attackers leverage ANSI codes (e.g., \u001b[2K) to manipulate terminal rendering, creating a "What You See Is NOT What the AI Gets" scenario that bypasses human oversight. ▶ MCP as a High-Value Target: As the bridge between LLMs and local environments, MCP's role in RAG and Agentic workflows makes it a critical point of failure for enterprise AI security. ▶ Legacy Tooling Obsolescence: Standard logging and DAST (Dynamic Application Security Testing) frameworks often fail to flag these injections because they focus on visual output rather than the raw byte-stream logic processed by tokenizers. Bagua Insight This vulnerability represents a sophisticated shift toward "Asymmetric Perception Attacks." In the GenAI era, the trust boundary has shifted; we can no longer rely on visual logs as the ground truth for system behavior. While humans see a clean terminal, the AI's tokenizer sees a roadmap for privilege escalation. This is a classic "Ghost in the Machine" exploit that targets the delta between human sensory limits and machine data parsing. As MCP gains traction as the industry standard for connecting LLMs to private data, this technique could become a go-to method for stealthy lateral movement within AI-integrated corporate networks. Actionable Advice To mitigate this risk, organizations must implement robust output sanitization at the MCP layer, stripping all non-essential ANSI escape sequences and non-printable characters before they reach the LLM. Security teams should pivot from visual log auditing to raw data stream analysis, ensuring that the "invisible" layer of communication is monitored. Furthermore, it is critical to deploy AI-native security scanners that can simulate these injection patterns to identify vulnerabilities in MCP-connected tools before they are exploited in the wild.

OpenAI has introduced GPT-Red, an automated red-teaming framework that leverages self-play mechanisms to autonomously discover vulnerabilities and harden Large Language Models (LLMs) against prompt injection and adversarial exploits. ▶ Paradigm Shift: AI safety is transitioning from human-in-the-loop manual red teaming to scalable, automated adversarial simulations, marking a critical milestone in the industrialization of AI alignment. ▶ Defensive Co-evolution: GPT-Red functions as a digital immune system; by generating synthetic attack vectors, it forces models to develop deeper robustness during the fine-tuning phase. Bagua Insight The launch of GPT-Red essentially applies the "Self-Play" logic—perfected by DeepMind during the AlphaGo era—to the domain of AI safety. Historically, red teaming has been the most expensive and least scalable bottleneck in AI deployment, relying heavily on the intuition of human security researchers. OpenAI is addressing the "Alignment Scaling" challenge: as model capabilities grow exponentially, human-led discovery of edge cases cannot keep pace. By pitting an "Attacker" model against a "Defender," OpenAI is building a closed-loop, autonomous hardening pipeline. This move is strategic—it’s not just about patching bugs, but about defining the automated benchmarks for what constitutes a "safe" model, effectively setting the global standard for AI governance. Actionable Advice For enterprise developers and CISOs, the message is clear: pivot from reactive patching to proactive adversarial simulation. First, move beyond static keyword filtering and integrate automated red-teaming into your LLM CI/CD pipelines. Second, when architecting RAG or Agentic workflows, prioritize defenses against the sophisticated injection techniques highlighted by GPT-Red; consider deploying a dedicated "guardrail model" at the inference layer. Finally, keep a close watch on potential API releases related to GPT-Red, as these automated safety evaluations are likely to become the de facto industry standard for production-grade GenAI.

Event Core Security research firm Mindgard has gone public with a critical 0-day vulnerability in Cursor, the leading AI-native code editor. The exploit leverages Cursor's RAG (Retrieval-Augmented Generation) pipeline to execute Indirect Prompt Injection, enabling attackers to exfiltrate environment variables, hardcoded secrets, and API keys simply by placing malicious natural language instructions within a codebase. ▶ The RAG Trust Fallacy: Cursor’s competitive edge—its ability to index an entire codebase for context—is its Achilles' heel. By treating retrieved snippets (from comments or .cursorrules files) as trusted context, the LLM can be hijacked to perform unauthorized data exfiltration or code manipulation. ▶ The Logic of Full Disclosure: Following a failed coordinated disclosure process where the vendor allegedly minimized the severity, the researchers opted for full disclosure to warn the developer community of the inherent risks in current AI-assisted workflows. Bagua Insight The Cursor exploit isn't just a patchable bug; it's a fundamental design flaw in the Instruction-Data Convergence of modern LLM applications. In the legacy world, we have the NX bit (No-eXecute) to prevent data from being run as code. In the GenAI era, we lack a semantic equivalent. Cursor’s RAG engine treats "data" (your code) as "instructions" (the prompt). When an attacker can influence the data, they effectively gain "God Mode" over the AI's output. This incident marks a turning point for the industry: the honeymoon phase of "AI-everything" is over, and the architectural debt of ignoring Indirect Prompt Injection in RAG pipelines is coming due. Actionable Advice For organizations and high-stakes developers: First, Sanitize the Context Window. Treat any third-party repository as a potential hostile input; do not allow AI agents to index unvetted legacy code or hidden config files with elevated privileges. Second, Environment Hardening. Use ephemeral dev containers and strictly scoped environment variables to minimize the blast radius of a potential leak. Finally, AI tool vendors must implement Output Filtering and Intent Validation—using a secondary, hardened LLM to verify that the primary model's actions haven't been subverted by retrieved context before any data leaves the local environment.

Event Core The research paper introduces Prismata, a novel framework designed to mitigate cross-site prompt injection attacks in Web Agents by enforcing granular context isolation during multi-site interactions. Bagua Insight ▶ The Collapse of Trust Boundaries: As Web Agents move toward autonomous API orchestration and web navigation, traditional Same-Origin Policies (SOP) are insufficient to mitigate LLM-specific semantic attacks. Prismata highlights that "context pollution" is now the primary security bottleneck in agentic workflows. ▶ A Shift in Defensive Paradigms: The industry is pivoting from simple prompt filtering to architectural isolation. By sandboxing data sources at runtime, developers can effectively strip malicious instructions of their execution authority before they reach the LLM core. Actionable Advice For Agent platform developers, it is critical to audit how external web content is ingested. Implementing a context isolation layer similar to Prismata is essential to ensure untrusted data cannot hijack the system prompt. When building RAG or Agentic systems, enforce strict principle-of-least-privilege (PoLP) for API calls to prevent agents from being coerced into executing unintended actions during cross-site operations.

Event Core Researchers at Noma Security have unveiled "GitLost," a vulnerability exploit targeting GitHub’s AI-native development environments like Copilot Workspace. By leveraging sophisticated prompt injection techniques, the team successfully manipulated AI agents into bypassing environment boundaries to exfiltrate sensitive code from private repositories. This research highlights a critical shift in the threat landscape: AI agents are no longer just productivity boosters; they are high-privilege targets for data breaches. ▶ The Rise of Agentic Attack Surfaces: As LLMs move from "chat" to "action," their ability to call tools and access file systems introduces a massive, unmanaged attack vector that bypasses traditional UI-based security. ▶ Logic-Level Sandbox Escape: The exploit demonstrates that technical sandboxing is insufficient if the AI's reasoning logic can be hijacked to justify unauthorized data access as a "legitimate" part of a coding task. ▶ Stealthy Exfiltration: By forcing the agent to send data to attacker-controlled endpoints via standard HTTP requests, the breach blends into legitimate developer traffic, making detection nearly impossible for standard EDR/DLP tools. Bagua Insight At 「Bagua Intelligence」, we view GitLost as a wake-up call for the "Agentic Era." The industry has spent years securing the model weights, but we are failing to secure the model's execution context. GitHub’s vulnerability stems from a fundamental mismatch between LLM autonomy and rigid IAM (Identity and Access Management) policies. When an agent inherits a user's broad permissions, any prompt injection becomes a full-scale privilege escalation. We are entering a phase where "Prompt Firewalling" is no longer enough; we need deep-kernel isolation for every AI-driven task execution to prevent cross-tenant or cross-repo contamination. Actionable Advice Organizations must adopt a "Zero Trust for Agents" posture. Do not grant AI agents persistent access to the entire codebase; instead, use ephemeral, task-scoped tokens. Implement strict output filtering to block the transmission of code-like patterns to external domains. Furthermore, security teams should treat AI-generated PRs and environment configurations with the same level of scrutiny as unverified third-party code, ensuring that no agentic workflow can trigger external network calls without explicit human authorization.

Event Core This report analyzes the paradigm-shifting research by Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell, which recontextualizes prompt injection as a fundamental "Role Confusion" failure. This framework highlights the inherent inability of LLMs to distinguish between privileged system instructions and untrusted user data. ▶ Structural Flaw, Not a Bug: Prompt injection is identified as a cognitive failure where the LLM conflates the "instruction channel" with the "data channel," allowing untrusted input to hijack the model's executive function. ▶ The Illusion of Mitigation: Current defenses, such as delimiters or "sandwich" prompts, are merely superficial. As long as instructions and data share the same token stream, the risk of role confusion remains an existential threat to LLM integrity. Bagua Insight At 「Bagua Intelligence」, we view the "Role Confusion" framing as a critical wake-up call for the GenAI industry. For too long, the industry has relied on "security theater"—using prompt engineering to fix a problem rooted in model architecture. As we transition from simple chatbots to autonomous AI Agents and RAG-heavy systems, the attack surface expands exponentially. If a model cannot maintain a semantic "Privilege Firewall," any AI connected to the open web is effectively a liability. This research underscores that true LLM security requires a fundamental rethink of how models ingest and prioritize input streams. Actionable Advice Developers must move beyond the "one more prompt will fix it" mentality. We recommend implementing a multi-layered defense-in-depth strategy: First, enforce the Principle of Least Privilege (PoLP) for all AI-accessible APIs. Second, utilize a dual-model architecture where a secondary, hardened LLM acts as a security gatekeeper to sanitize inputs. Finally, ensure that high-stakes actions—especially those involving data exfiltration or financial transactions—always require a "Human-in-the-loop" verification step to prevent automated exploitation.

Event Core Security researchers successfully exploited the AI assistant of Dutch neobank bunq by initiating a €0.01 transfer, effectively bypassing safety guardrails and demonstrating how LLM-driven agents can be manipulated to execute unauthorized financial transactions. Bagua Insight ▶ The Financialization of Prompt Injection: AI agents are bridging the gap between natural language and system execution. When LLMs are granted direct API access to financial infrastructure, traditional prompt injection shifts from a data privacy concern to a direct threat to capital integrity. ▶ Semantic-Execution Mismatch: The vulnerability highlights a critical architectural flaw: banking systems rely on rigid, rule-based logic, while AI agents operate on fluid, probabilistic semantic interpretation. This mismatch creates a 'semantic gap' where malicious intent is masked as legitimate user instructions. Actionable Advice Mandatory Human-in-the-Loop (HITL): For any agentic workflow involving movement of funds or sensitive data, implement a hard-coded human approval step that cannot be bypassed by the LLM's reasoning engine. API Sandboxing & Least Privilege: Adopt a strict 'Least Privilege' model for AI agents. Separate read-only information retrieval from write-access transaction APIs, and ensure the agent operates within a restricted execution environment.

Event CoreMeta has confirmed a significant security breach where attackers manipulated its integrated AI chatbot to gain unauthorized access to thousands of Instagram accounts. By exploiting logical flaws in the AI's account recovery workflows, hackers successfully bypassed security checkpoints and triggered unauthorized password resets. While Meta has patched the vulnerability, the incident serves as a stark warning regarding the risks of embedding LLMs into sensitive administrative functions.▶ The Rise of Semantic Exploits: Attackers are shifting from traditional phishing to manipulating the logic of trusted AI agents to perform unauthorized actions.▶ Authentication Gap: The breach highlights a critical failure in how AI agents interface with backend identity management APIs without sufficient secondary validation.Bagua InsightThis incident represents a systemic collapse of the "Trust Boundary" in the GenAI era. In its push to automate customer support and enhance UX via AI, Meta inadvertently created a high-privilege backdoor. The core issue is "Agentic Overprivilege"—granting an AI the power to modify sensitive user data without enforcing strict, non-AI-mediated friction (like MFA). This marks a pivot in the threat landscape: we are moving from code-based exploits to logic-based manipulation where the AI's helpfulness is weaponized against the user.Actionable AdviceFor Users: Transition immediately to phishing-resistant MFA (WebAuthn or Authenticator apps). Relying on SMS or email-based recovery is no longer sufficient when AI can be coerced into bypassing these flows.For Enterprises: Implement "Human-in-the-loop" or multi-signature requirements for any high-risk action initiated by an AI agent. AI should suggest actions, not execute them autonomously for sensitive account changes.Red Teaming: Expand security audits to include "Adversarial Prompting" specifically targeting business logic. Organizations must treat AI interactions as untrusted input, similar to how they treat SQL queries or API calls.

Researchers from the University of Toronto, in collaboration with Cornell Tech and Technion, have demonstrated "Morris II," a self-replicating generative AI worm. This malware leverages adversarial self-replicating prompts to hijack LLM-based agents, enabling autonomous data exfiltration and spam propagation across interconnected AI ecosystems. ▶ Paradigm Shift in Malware: Cyber threats are evolving from executable scripts to semantic-based adversarial prompts, weaponizing the LLM's reasoning engine for zero-click infection. ▶ Weaponizing RAG: The worm exploits Retrieval-Augmented Generation (RAG) to persist within vector databases, turning trusted knowledge bases into launchpads for cross-session contagion. ▶ Systemic Risk in Agentic Economies: As AI Agents become increasingly interconnected via APIs, a single compromised node can trigger a cascading failure across entire automated workflows. Bagua Insight We are witnessing the "Morris Moment" for the GenAI era. Just as the 1988 Morris worm exposed the fragility of the early internet, Morris II highlights a fundamental architectural flaw in modern LLM deployments: the blurring of boundaries between data and instructions. In the industry's rush toward "Agentic Workflows," developers often operate under the naive assumption that retrieved context is benign. However, this research proves that as long as an AI can process data and generate subsequent actions, it can be weaponized. This isn't just a bug; it's a structural vulnerability in how we build autonomous systems. The very feature that makes LLMs powerful—their ability to follow complex instructions—is exactly what makes them susceptible to semantic hijacking. If we don't establish a "Semantic Firewall," the AI assistants designed to boost productivity could become the ultimate Trojan horses within corporate networks. Actionable Advice 1. Deploy Semantic Sandboxing: Developers must implement an intermediate sanitization layer in RAG pipelines, using specialized micro-models to scan retrieved context for adversarial patterns before it reaches the core LLM. 2. Enforce Human-in-the-Loop (HITL): For high-stakes Agent actions, such as mass emailing or database modifications, autonomous execution must be gated by explicit human approval to prevent viral propagation. 3. Adopt Zero-Trust AI Architectures: Treat every output from an external AI Agent or a RAG retrieval as untrusted. Implement strict schema validation and output filtering to ensure the LLM doesn't inadvertently execute embedded commands.

Security researchers have identified a critical vulnerability in the widely-used "GPT for Google Sheets" extension. The flaw allows attackers to weaponize Indirect Prompt Injection to silently exfiltrate entire workbook contents to external servers, putting millions of enterprise and individual users at risk. ▶ Broken Permission Models: Third-party AI add-ons often operate with excessive read/write scopes. When these tools render AI-generated Markdown or image links without strict sanitization, they create a covert channel for data exfiltration. ▶ The Evolution of Prompt Injection: AI is no longer just a chatbot; when integrated into productivity suites, it becomes a stealthy conduit for data theft. A simple malicious string in a single cell can trigger a full-scale data breach. Bagua Insight This vulnerability isn't just a bug; it's a structural misalignment between LLM capabilities and SaaS integration security. The rush to monetize AI productivity has led to a "functionality-first, security-later" mindset in the plugin ecosystem. This is a textbook case of "Shadow AI" risks—where employees bypass IT protocols to adopt unvetted tools, inadvertently exposing corporate intellectual property to unshielded AI inference chains. For sophisticated actors, this represents a low-cost, high-stealth vector for industrial espionage that bypasses traditional network perimeters. Actionable Advice Permission Audit: IT administrators should immediately audit Google Workspace environments to identify and revoke access for non-sanctioned AI add-ons with broad "Read/Write" scopes. Enforce Zero Trust for AI: Prohibit the use of third-party AI automation tools on workbooks containing PII (Personally Identifiable Information) or sensitive financial data. Upgrade DLP Rules: Enhance Data Loss Prevention (DLP) strategies to specifically monitor and block outbound requests from productivity apps that carry suspicious payloads, such as Base64-encoded strings or anomalous URL parameters.

Event CoreA developer on the LocalLLaMA subreddit has claimed to have embedded a malicious prompt injection—effectively a 'logic bomb'—into a codebase to target 'vibe coders.' These are users who build software by blindly following LLM suggestions without understanding the underlying mechanics. The injection is designed to trick an LLM into executing destructive commands, such as data deletion, when processing the code.▶ Weaponized Prompt Injection: The threat vector has evolved from simple chatbot manipulation to stealthy sabotage within production-adjacent codebases.▶ Engineering Culture Clash: This incident signals a growing militant backlash from traditional engineers against the 'hallucination-driven development' trend.▶ The Fragility of the Human-in-the-Loop: The incident highlights that when the 'human' in the loop is merely a 'vibe checker,' they become the primary vector for security breaches.Bagua InsightThis is a seminal moment in the GenAI era, marking the transition of prompt injection from a theoretical curiosity to a practical tool for ecosystem sabotage. 'Vibe coding' relies on the assumption that LLMs are benign or that their errors are merely functional; this incident proves that the context window is a new attack surface. By poisoning the documentation or comments that an LLM reads, an attacker can turn an AI agent into an unwitting insider threat. As RAG (Retrieval-Augmented Generation) and autonomous agents gain deeper integration into enterprise workflows, the risk of 'indirect prompt injection' becomes a critical failure point for any system granting AI write-access to environments.Actionable AdviceOrganizations must pivot to a 'Zero Trust' posture for AI-generated outputs. Never execute AI-suggested scripts or code snippets outside of a strictly hardened sandbox. Furthermore, code review protocols must be updated to scan for 'linguistic malware'—hidden prompts designed to hijack LLM logic. Finally, companies must distinguish between 'AI-assisted' and 'AI-automated' workflows; the latter requires rigorous output parsing and formal verification that most current 'vibe coding' setups lack.

Researchers have identified a sophisticated new threat vector termed "Domain-Camouflaged Injection," which weaponizes domain-specific semantic contexts to bypass safety filters in multi-agent LLM systems with high success rates. ▶ Semantic Camouflage: By embedding malicious payloads within the specialized lexicon of fields like law or medicine, attackers ensure the injection is indistinguishable from legitimate business data, rendering traditional pattern-matching defenses obsolete. ▶ Trust Chain Exploitation: In complex agentic workflows, the inherent trust between specialized agents becomes a vulnerability. A single compromised input can propagate through the system, allowing attackers to escalate privileges or exfiltrate data via lateral movement between agents. Bagua Insight This is a paradigm shift in LLM red-teaming. We are moving away from the era of "jailbreak prompts" and into a phase of "semantic subversion." The brilliance—and danger—of domain-camouflaged attacks lies in their alignment with the LLM's primary strength: contextual reasoning. When the attack logic is indistinguishable from the business logic, the defense mechanism faces a recursive failure. For enterprises betting their automation ROI on multi-agent systems, this research is a wake-up call that the "trust-by-default" model in agent communication is fundamentally broken. The battleground has shifted from the input prompt to the inter-agent protocol. Actionable Advice Enterprises must pivot from perimeter-based security to a "Zero-Trust Agent Architecture." First, implement semantic sanity checks at every inter-agent handoff point, using secondary "Inspector Models" to detect logic anomalies rather than just keywords. Second, enforce strict Least Privilege Access (LPA) for all agent-tool integrations, ensuring a breach in one domain doesn't grant keys to the entire kingdom. Finally, adopt a "Supervisor-in-the-loop" strategy where an independent auditor agent monitors the execution trace of autonomous workflows for non-sequitur behavioral patterns.

Bagua Insight While structured data can be isolated via middleware like DataGate, unstructured data—such as web documents—remains a critical attack vector for LLMs. A comprehensive benchmark across 15 models and 6,100+ tests reveals that injecting structural constraints, specifically delimiters and strict prompt enforcement, can skyrocket defense rates from 21% to 100%. This underscores a shift in security posture: prompt engineering is no longer just about utility, but a fundamental layer of the model's security architecture. ▶ The Paradigm Shift: Security is moving away from external filtering toward structural context isolation. Delimiters are currently the most cost-effective defensive primitive. ▶ Instruction-Following vs. Scale: The data proves that high-fidelity defense is less about parameter count and more about the model's ability to adhere to rigid structural constraints, validating that prompt architecture can effectively bridge security gaps in smaller models. Actionable Advice Engineers must integrate mandatory delimiter protocols into their RAG pipelines immediately. Treat 'defensive prompting' as a top-tier system instruction rather than an auxiliary filter, ensuring that all external content is encapsulated within strictly defined boundaries before model ingestion.