Field notes: the prompt injections that still work in 2026

Prompt injection has been public knowledge for years, and defenses have gotten meaningfully better. And yet, in our assessments, a surprising number of the injections that succeed aren't exotic — they're simple, and they work because defenses were tuned against the exotic ones.

We look at a handful of patterns from recent assessments (details anonymized), grouped by why they slipped through: over-indexing on known jailbreak phrasing, under-testing multi-turn setups, and trusting retrieved content more than user input.

The common thread: testing has to be adversarial and continuous, not a one-time checklist run against a known attack list.