Field Reference · Structural Analysis · v2 · expanded taxonomy

Seventeen ways a language model fails when the context grows long.

Four distinct dimensions of failure — positional, qualitative, structural, behavioral — distribute unevenly across the LLM pipeline. More pathologies surface at the attention layer than at any other stage; behavioral failures emerge only downstream. Understanding which dimension produced a given failure tells you which layer of the stack can fix it — and which cannot be patched by prompting at all.

3Positional
5Qualitative
5Structural
4Behavioral
17Total pathologies
5Pipeline stages
How to read
this atlas

The atlas has five complementary maps. Map A places all 17 pathologies on a 2D grid where rows are dimensions (color-coded) and columns are pipeline stages where the failure surfaces. Empty cells are informative — they show that, e.g., behavioral pathologies never originate at the input stage. Map B isolates one typical failure cascade — a "death spiral" that turns one upstream failure into a session-wide breakdown. Map C is the defensive architecture: a two-run verification pattern that addresses the two critical-severity pathologies (P07, P08) plus the two that propagate across runs (P15, P17) at once. Map D is the master matrix for filtered lookup. Map E is a qualitative simulator — pull a parameter slider to see which pathologies respond.

Click any node in Map A or Map B to open the detail panel (Layer 2: mechanism, when it strikes, mitigation effectiveness with concrete percentages). Inside that panel, reveal the prompt or architecture pattern as Layer 3 when you want concrete code. The single insight to walk away with: the attention layer alone hosts 6 of the 17 pathologies — it is the single most fragile component in a long-context system, and no single fix tier covers it.

Three caveats on Class 1. First, the 4×5 matrix and every cell assignment are this atlas's own construct — a way to order the phenomena, not a measured taxonomy; the per-pathology Source tag marks which entries are empirically replicated, which come from a practitioner blog taxonomy, and which are framing. Second, several of these effects are model-generation-dependent: newer frontier models measurably dampen some of them, so treat severities as relative, not fixed. Third, the dimensions are not perfectly orthogonal — Context Rot, Attention Dilution and Context Distraction overlap heavily, and Context Rot reads more as an umbrella for gradual long-context decay than as a peer of the other two.

Three classes sorted by where the failure originates#

The seventeen above are only the first class — failures that live around the context window. Two further classes sit deeper and behave differently: one in the model core, one only in the integrated application. The axis that separates them is where the failure is born and how far it can be cured.

Class 1 · Intrinsic-contextual
Failures around the context window
Where it is bornThe context window. Training and architecture artefacts that become visible in the model's own output as the context grows.
How far it curesDampenable. Prompt, retrieval and architecture patterns measurably reduce them — none disappears entirely.
In this atlasThe 17 pathologies, the 4×5 matrix and Maps A–E below.
Class 2 · Intrinsic-structural
Defects of the model core
Where it is bornBelow the context window. Knowledge, generation and training defects that need no long context to appear — present even on a one-line prompt.
How far it curesStructurally unavoidable. You manage and bound them; you do not patch them away.
In this atlasSeven entries, deliberately no matrix — they do not sit at a pipeline stage.
Class 3 · Integrative-security
Born in the integrated application
Where it is bornThe integration, not the model. It appears only once the model is wired into an application that mixes trusted and untrusted text in one context.
How far it curesDamage-control only. No training fix is on the horizon — the boundary the defence needs does not exist in the architecture.
In this atlasPrompt injection, treated as its own category.

Color · Dimension of Failure

Positional — failures of where information sits in the context
Qualitative — failures of what content is in the context
Structural — failures rooted in the transformer architecture
Behavioral — emergent from RLHF + long interaction

Lines · Causal Type

Direct cause — A architecturally forces B
Amplification — A makes B more frequent / worse
Feedback — B re-enters context, compounds A

Position · Pipeline Stage

INPUTPre-processing, what reaches the model
ATTENTIONHow the transformer distributes weight
GENERATIONToken-by-token output production
INTERACTIONOne round-trip with the user
SESSIONMany turns, accumulated context
Class 1 Intrinsic-contextual The seventeen failures around the context window — dampenable artefacts of training and architecture that surface in the model's own output. Maps A–E chart them across four dimensions and five pipeline stages.

Map A The atlas — 17 pathologies, four dimensions, five stages#click any node →

scroll →
Stage 01 Input Stage 02 Attention Stage 03 Generation Stage 04 Interaction Stage 05 Session Positional where info sits 3 pathologies Qualitative what content is in 5 pathologies Structural how the arch works 5 pathologies Behavioral RLHF + long interact. 4 pathologies — — — — — — — — — P01 Lost in the Middle ●●●●○ P02 Needle-in-Haystack ●●●○○ P03 Context Rot P04 Context Distraction ●●●○○ P05 Multi-Doc Interference ●●●○○ P06 Parametric Memory Bias ●●●●○ P07 Confidence Hallucination ●●●●● P08 Context Poisoning ●●●●● P09 Context Window Limit ●●●●○ P10 Context Fragmentation ●●●●○ P11 Instruction Dilution ●●●○○ P12 Attention Dilution ●●●○○ P13 Length Extrapol. Failure ●●●●○ P14 Repetition Loops ●●●○○ P15 Sycophancy ●●●○○ P16 Context Drift ●●●○○ P17 Inference Nondet.
#
Mechanism — what is happening
When it strikes
    Position in the cascade
    Sources
    Mitigation effectiveness
    Hand-tuned estimates · not empirical, not predictive — relative guidance only.
    Layer 3 · Concrete pattern
    
            
    
          
    
        
    
      
    
    
    
  
    

  
  
    
    
    Map B The death spiral — one input failure becomes a session-wide breakdown#read left to right →
    

    
    
      scroll →
      
    
        
    
          
        
          
            
          
          
            
          
          
            
          
        

        
        Origin
        Input limit
        Stage 1
        Bad input quality
        Stage 2
        Attention failure
        Stage 3
        Generation invents
        Stage 4
        Error in context
        Stage 5
        Session drift

        
        
        
        
        
        

        

        
        
          
          
          P09 · STRUCTURAL
          Context Window Limit
        

        
        
        forces

        
        
          
          
          P10 · STRUCTURAL
          Fragmentation
        

        
        
        amplifies

        
        
          
          
          P01 · POSITIONAL
          Lost in the Middle
        

        
        
        drives

        
        
          
          
          P07 · QUALITATIVE
          Confidence
          Hallucination
          CRITICAL
        

        
        
        enters

        
        
          
          
          P08 · QUALITATIVE
          Context Poisoning
        

        
        
        locks in

        
        
          
          
          P16 · BEHAV
          Context Drift
        

        

        
        
          
          
          P12 · STRUCTURAL
          Attention Dilution
        
        

        
          
          
          P06 · QUALITATIVE
          Parametric Memory Bias
        
        

        
        
          
          
          P11 · STRUCTURAL
          Instruction Dilution
        
        

        
          
          
          P15 · BEHAVIORAL
          Sycophancy
        
        

        
        
        enables

        
        
        autoregressive feedback — output re-enters input

        
        ⎯  primary cascade
        - - feeders (amplify or enable downstream node)
        ··· feedback loop (output becomes input)

      
        
    
      
    
      

      
    
        The structural insight
        Every node in the main cascade (red) can be triggered or amplified by feeders (amber) arriving from above or below. By the time Context Drift (P16) is visible to the user, the upstream cascade has usually been active for many turns — drift is the symptom, not the disease. The dotted feedback loop is the most dangerous mechanism: hallucinated content enters the next prompt as "ground truth", and the model becomes consistent with its own errors. This is why "ask the model to double-check" cannot work — the model is checking its own contaminated context. On the entry point: this route starts at the context-window limit (P09 → P10), but that is not the empirically most common trigger — early false commitments under under-specified prompts are. Read this as one representative path, not the only or the most frequent one.
      
    
    
    
  
    

  
  
    
    
    Map C The defensive architecture — two-run adversarial verification#
    

    
    
      
    
        
    
          
    Run 1 · Source-only Extraction
    
          
      
            
    • Parametric memory suppressed by prompt
      • 
            
    • Sequential inventory pass over chunks
      • 
            
    • Per-claim citation required: §, sentence
      • 
            
    • Permitted output: CONFIRMED or NOT FOUND
      • 
            
    • No interpretation, no synthesis
      • 
          
    
        
    
        
    →
    
        
    
          
    Run 2 · Adversarial Audit
    
          
      
            
    • Fresh context — Run 1 framing not visible
      • 
            
    • User's prior thesis hidden from prompt
      • 
            
    • Default stance: assume Run 1 is wrong
      • 
            
    • Cross-check: claim ↔ document
      • 
            
    • Cross-check: claim ↔ claim (consistency)
      • 
          
    
        
    
        
    →
    
        
    
          
    Delta Report · User Output
    
          
      
            
    • ✓ Confirmed — both runs agree, source cited
      • 
            
    • ~ Partial — gap or weak evidence
      • 
            
    • ✗ Not in document — Run 1 invention
      • 
            
    • ⚡ Contradiction — claims conflict
      • 
            
    • Per-claim confidence score
      • 
          
    
        
    
      
    

      
    
        Critical constraint — addresses the two critical-severity pathologies (P07, P08) plus the two that propagate across runs (P15, P17) at once
        Run 2 must not see Run 1's framing or the user's original interpretation. Sycophancy propagates across runs whenever framing leaks. This is why a simple "double-check your work" prompt fails: the model is checking its own claim under its own framing — and worse, under Context Poisoning, it is checking against an already-contaminated context.
        
    
          Mitigates: P07 Hallucination
          P08 Poisoning
          P15 Sycophancy
          P17 Inference Nondeterminism
        
    
      
    
    
    
  
    

  
  
    
    
    Map D Master reference — all 17 pathologies, sortable by dimension#
    

    
    
      Filter:
      
      
      
      
      
    
    

    
    
      
    
        
          
    
            Pathology
            Dimension
            Stage
            Severity
            Frequency
            Prompt-fixable
          
    
            
        
      
    
    
    
  
    

  
  
    
    
    Map E The simulator — pull a parameter, watch the risks shift#qualitative model →
    

    
    
      
    
        Qualitative model · not empirical · not predictive
        The bars show the shape of how each pathology responds to changes in the inputs — direction of effect, relative steepness, which lever triggers what. The functions are hand-tuned to match the structural mechanics described in this atlas; they are not calibrated against any benchmark and not specific to any model. Use this to build intuition. Do not use it to predict probability.
      
    

      
    
        
    
        
    
      
    

      
    
        Scenarios:
      
    
    
    
  
    

  
  
    
    Class 2
    Intrinsic-structural
    Defects that sit below the context window — knowledge, generation and training artefacts that appear on a one-line prompt, with no long context required. These are structurally unavoidable: you bound and manage them, you do not patch them away. Presented as cards, not a matrix — they do not live at a pipeline stage.
  
    

  
    
    
    

      
    
        
    B1
    Confabulation as a statistical inevitability
    
        
    Hallucination is not a bug awaiting a patch — it is a structural property of training a generator by next-token prediction.
    
        
    Mechanism
    
        
    Kalai, Nachum, Vempala & Zhang1 recast generation as implicitly solving a binary classification — is this statement valid? When valid and invalid statements are not separable from the training data, a base error rate is forced already in pretraining, independent of any context. Kalai & Vempala2 give a harder lower bound for well-calibrated models on facts that cannot be derived from the training distribution (e.g. one-off facts seen once). The nuance, kept rather than smoothed: the 2025 result also qualifies "inevitable" — a model could abstain under uncertainty; hallucination persists largely because evaluations reward confident guessing over an honest "I don't know." So two OpenAI-adjacent results pull in slightly different directions on how unavoidable it is — a statistical floor on one hand, an incentive problem on the other. This is the structural root beneath P07 Confidence Hallucination, which is its contextual face; its calibration symptom is B4, and its other horn is B6.
    
        
    When it bites
    
        
    • Any claim about long-tail or one-off facts seen rarely in training
    • Open-ended generation with no retrieval grounding
    • Setups that reward a confident answer over an honest "I don't know"
    
        
    How it's handled
    
        
    Cannot be trained away — only bounded. Ground claims in retrieval so they are checkable, make abstention ("NOT FOUND") an accepted output, and stop evals from rewarding confident guessing. Every P07 mitigation is, at root, B1 damage control.
    
      
    

      
    
        B1 ⇄ B6 · two ends of one trade-off
        Kalavasis, Mehrotra & Velegkas7 prove a generator that pushes beyond its training data must either emit invalid strings (hallucinate, B1) or fail to cover the full set of valid ones (mode collapse, B6) — you cannot drive both to zero. Read B1 and B6 not as separate defects but as the two horns of a single theorem. RLHF buys consistency at the cost of breadth.
      
    

      
    
        
    B6
    Mode collapse / diversity loss
    
        
    RLHF narrows the output distribution: the model converges on a few safe templates and loses valid variety it could produce.
    
        
    Mechanism
    
        
    The formal counterpart to B17: a model tuned hard for validity collapses toward a sub-set of acceptable outputs. Distinct from P15 Sycophancy (agreement-seeking) — mode collapse is verbatim distributional narrowing, visible as repetitive phrasings, identical openings, and a shrinking idea space even when many valid answers exist.
    
        
    When it bites
    
        
    • Brainstorming, creative writing, or any task needing variety across samples
    • Repeated calls returning near-identical openings and structures
    • Synthetic-data generation where covering the valid space matters
    
        
    How it's handled
    
        
    Manage the breadth/validity trade-off (the B1 ⇄ B6 theorem). Raise temperature / nucleus, vary prompts and seeds, or run an explicit diversity pass — and accept that pushing variety up nudges validity down. You cannot have both maximal at once.
    
      
    

      
    
        
    B2
    CoT unfaithfulness
    
        
    A reasoning model's visible "thinking" is often a post-hoc rationalisation, not the actual cause of its answer.
    
        
    Mechanism
    
        
    Anthropic3 found models that used an injected hint to reach an answer rarely admitted the hint in their CoT; longer chains tended to be less faithful, dressing up the real reason rather than exposing it. Turpin et al.4 showed the same on earlier models. This undermines "watch the model think" as a safety story — the trace is generated text, not a window into the computation.
    
        
    When it bites
    
        
    • Treating a chain-of-thought as a faithful audit trail of the answer
    • Oversight schemes that "read the reasoning" to catch misbehaviour
    • Longer reasoning chains — which tend to be less faithful, not more
    
        
    How it's handled
    
        
    Don't trust the trace as the cause. Verify against outcomes, not stated reasoning; use independent checks — a second run, tool-grounded verification — rather than reading the CoT. Treat the chain as generated text that may be plausible cover.
    
      
    

      
    
        
    B3
    The reversal curse
    
        
    Trained on "A is B", the model fails to answer "B is A".
    
        
    Mechanism
    
        
    Berglund et al.5 — a pure generalisation artefact of the direction in which facts were seen during training, with no context involved. Not the same as P06 Parametric Memory Bias (memory winning over context): here the symmetric association genuinely was never learned. Persists across model sizes and families.
    
        
    When it bites
    
        
    • Querying a fact in the opposite direction from how it appears in the data
    • Symmetric relations assumed to be bidirectional (equivalences, inverses)
    • Recall tasks that lean on the model's parametric memory
    
        
    How it's handled
    
        
    Don't rely on parametric recall for inverse look-ups. Put both directions in context — retrieval, a structured knowledge base — or store relations symmetrically. A context-grounded answer sidesteps the missing association entirely.
    
      
    

      
    
        
    B4
    Miscalibration / RLHF overconfidence
    
        
    After pretraining a base model is relatively well-calibrated; RLHF degrades calibration — the model sounds surer than it is.
    
        
    Mechanism
    
        
    The GPT-4 technical report6 documents calibration worsening after RLHF. Keep this distinct: B4 is specifically the model's probability estimates drifting from reality, not the confident-false-content behaviour of P07 nor the statistical floor of B1. It couples to both B1 and P15 Sycophancy — all three are RLHF-induced.
    
        
    When it bites
    
        
    • Reading a model's stated confidence or tone as a probability estimate
    • Routing or abstention logic keyed on the model "sounding sure"
    • Any RLHF-tuned chat model post-alignment — base models are better calibrated
    
        
    How it's handled
    
        
    Don't read fluency as confidence. Where you need calibrated uncertainty, derive it externally — sampled agreement, logprob-based scoring, or an explicit verifier — rather than the model's self-report. Couples to B1 and P15.
    
      
    

      
    
        
    B5
    Tokenisation artefacts
    
        
    Counting letters, spelling and digit arithmetic fail at the BPE tokenizer, not at "intelligence."
    
        
    Mechanism
    
        
    The model sees tokens, never characters. Asked how many D's appear in "DEEPSEEK", several models answered anywhere from two to seven — none correct1. The reasoning machinery is given a sub-word encoding in which the individual letters are simply not present, so character-level questions have no reliable substrate to operate on.
    
        
    When it bites
    
        
    • Character-level tasks: counting letters, spelling, reversing strings, acrostics
    • Digit-by-digit arithmetic and exact numeric formatting
    • Tokeniser edge cases — rare scripts, whitespace, emoji
    
        
    How it's handled
    
        
    Move character and digit work out of the model. Use code or tools for counting, arithmetic and string manipulation; pre-split into explicit characters when the task truly needs them. No prompt makes the individual letters visible to the model.
    
      
    

      
    
        
    B7
    Prompt brittleness
    
        
    The same question, reformatted, yields a different answer.
    
        
    Mechanism
    
        
    Sclar et al.8 show sensitivity to spurious formatting features — delimiters, casing, the order of few-shot examples — moving accuracy by tens of points, and the sensitivity survives larger models and instruction tuning. Why it is its own entry, not P17 or P04: P17 Inference Nondeterminism is non-determinism over a session (same prompt, different times); P04 Context Distraction is noise inside the context. B7's trigger is the surface form of the prompt itself — a training-intrinsic defect that fires even on a single, clean, short query.
    
        
    When it bites
    
        
    • Same task, different formatting (delimiters, casing, example order) → different accuracy
    • Few-shot prompts sensitive to example selection and ordering
    • Benchmark scores that swing with cosmetic prompt edits
    
        
    How it's handled
    
        
    Don't over-fit to one phrasing. Evaluate across format variations, fix a canonical template, and ensemble over paraphrases where it matters. Treat any single-prompt score as a point estimate with real variance.
    
      
    

    
    
  
    

  
  
    
    Class 3
    Integrative-security
    A failure that does not exist in the model alone — it is generated by the integration. The moment an LLM is wired into an application that pours trusted instructions and untrusted external text into one context, a security hole opens that the model cannot close. The defence is damage control, not a cure.
  
    

  
    
    
    Prompt injection the one boundary the architecture does not have#
    

    
    
      
    Root cause — instruction and data are inseparable
    
      
    Every proposed defence reduces to one wish: keep instructions and data apart. Architecturally, that wish cannot be granted. The model is handed a single, undifferentiated token stream; there is no field, tag or type that marks "this span is a command" versus "this span is data to be processed." Syntax and semantics share one channel.
    
      
    Zverev et al.9 make this measurable: they define a formal separation score and, on their SEP dataset, show that no model achieves high separation — and that the usual mitigations (prompt engineering, fine-tuning) barely move the score or buy separation only by sacrificing usefulness.
    
    
    

    
    
      
    The didactic parallel — SQL injection, and W^X
    
      
    This is the same construction flaw as classic SQL injection: control instructions and user data travelling over one channel, so data crafted to look like a command gets executed as one. Computer security solved its analogues by building a hard boundary the LLM stack lacks — memory is writable exclusive-or executable (W^X), and data is, by rule, never executed. An LLM agent has no such guarantee: a sentence retrieved from a web page can act as an instruction the moment it enters the context.
    
    
    

    
    
      
    
        
    
          
    Direct injection
    
          
      
            
    • The user types the override themselves — "ignore previous instructions and …".
      • 
            
    • The attacker is the user; the blast radius is their own session.
      • 
            
    • Bounded, and the case most early demos showed12.
      • 
          
    
        
    
        
    ›
    
        
    
          
    Indirect injection
    
          
      
            
    • The attacker plants instructions in data the model will later retrieve — a document, an email, a web page.
      • 
            
    • They steer the system remotely, with no direct interface to it10.
      • 
            
    • The agent-relevant, and substantially more dangerous, case.
      • 
          
    
        
    
      
    

      
    
        Not the same as P08 Context Poisoning
        P08 is the model poisoning itself — its own hallucination re-enters the context and becomes "ground truth." Prompt injection is a deliberate external adversary exploiting the missing instruction/data boundary. The symptom surface is similar (untrusted content becomes authoritative), but the origin is opposite — and that is exactly why this is a separate class, not another cell in the matrix. Note too that the practitioner term "context poisoning" is sometimes used for injection; in this atlas P08 means the self-inflicted variety only.
      
    

      
    
        Status · unsolved
        Prompt injection sits at LLM01 — number one on the OWASP Top 10 for LLM Applications, 202514. Around the launch of its Atlas browser in late 2025, OpenAI publicly called prompt injection a frontier, unsolved security problem16 — and, in a December 2025 security update, one that is unlikely to ever be fully solved15. There is no "train it away" trajectory on offer — only damage control: layered defence, spotlighting, and guardrail models11, never a cure. The term was coined by Simon Willison in 202213; the first systematic attack study is Perez & Ribeiro, the same year12.
      
    
    
    

    
    
      
    The reframe — stop trying to solve it in the model
    
      
    The honest move the field made was to drop the model-level question. You do not make the model injection-proof; you build the system so a fooled model can do no harm. The trust boundary moves out of the model and into the architecture — classic security discipline: least privilege, taint-tracking, control/data-flow separation.
    
      
    CaMeL17 is the worked example: a privileged planner is constructed only from trusted user input, while everything that touches untrusted data is treated as tainted and cannot trigger a privileged action. The model can still be deceived — it just cannot reach anything that matters.
    
      
    The practical lever is Willison's "lethal trifecta"18: catastrophe needs three ingredients at once — access to private data, exposure to untrusted content, and a way to exfiltrate. Break any one leg and a successful injection drops from disaster to nuisance.
    
      
    And to be precise about "unsolvable": there is no impossibility proof here, unlike the halting problem. The right analogy is adversarial robustness and human social engineering — an open input space against an adversary, reducible to acceptable residual risk, not eliminable. "Latently unsolvable" means structurally resistant — shown empirically, not proven impossible. What wins is boring engineering discipline, not a clever prompt patch.
    
    
    
  
    

  
  
    
    
    References sources for Class 2 & Class 3#
    
    
      
      
    1. Kalai, Nachum, Vempala & Zhang (2025). Why Language Models Hallucinate. arXiv:2509.04664
      2. 
      
    2. Kalai & Vempala (2024). Calibrated Language Models Must Hallucinate. arXiv:2311.14648
      3. 
      
    3. Anthropic — Chen et al. (2025). Reasoning Models Don't Always Say What They Think. arXiv:2505.05410
      4. 
      
    4. Turpin et al. (2023). Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting. arXiv:2305.04388
      5. 
      
    5. Berglund et al. (2023). The Reversal Curse: LLMs Trained on "A is B" Fail to Learn "B is A". arXiv:2309.12288
      6. 
      
    6. OpenAI (2023). GPT-4 Technical Report — calibration degradation after RLHF (Fig. 8). arXiv:2303.08774
      7. 
      
    7. Kalavasis, Mehrotra & Velegkas (2024). On the Limits of Language Generation: Trade-Offs Between Hallucination and Mode Collapse (STOC 2025). arXiv:2411.09642
      8. 
      
    8. Sclar, Choi, Tsvetkov & Suhr (2023). Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design. arXiv:2310.11324
      9. 
      
    9. Zverev et al. (2024). Can LLMs Separate Instructions From Data? And What Do We Even Mean By That? arXiv:2403.06833
      10. 
      
    10. Greshake et al. (2023). Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. arXiv:2302.12173
      11. 
      
    11. Abdelnabi et al. (2024). Get my drift? Catching LLM Task Drift with Activation Deltas. arXiv:2406.00799
      12. 
      
    12. Perez & Ribeiro (2022). Ignore Previous Prompt: Attack Techniques For Language Models. arXiv:2211.09527
      13. 
      
    13. Willison (2022). Prompt injection attacks against GPT-3. blog · not peer-reviewed · coined the term simonwillison.net
      14. 
      
    14. OWASP (2025). Top 10 for LLM Applications — LLM01: Prompt Injection. genai.owasp.org
      15. 
      
    15. OpenAI (2025). Continuously hardening ChatGPT Atlas against prompt injection attacks. openai.com
      16. 
      
    16. Stuckey (2025). OpenAI CISO on prompt injection in ChatGPT Atlas — "a frontier, unsolved security problem". statement · OpenAI CISO · not peer-reviewed simonwillison.net
      17. 
      
    17. Debenedetti et al. — Google DeepMind (2025). Defeating Prompt Injections by Design (CaMeL). arXiv:2503.18813
      18. 
      
    18. Willison (2025). The lethal trifecta for AI agents: private data, untrusted content, and external communication. blog · not peer-reviewed · coined the term simonwillison.net
      19.