Tap a claim on the ring to put it at the centre.
← Prompt injection is unsolved, but the latest models are post-trained…
17 connected korrents · 17 moments from 10 Dec 2015 to 17 Sept 2026.
Everything filed under prompt injection
prompt injection
Everything filed under LLMs
LLMs
Everything filed under scaling laws
scaling laws
Everything filed under reinforcement learning
reinforcement learning
Everything filed under neural networks
neural networks In tension Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Read this korrent: Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now. Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now. Last stated 8 months ago
12 Feb 2026
PS
Peter Steinberger — holds since 2026-02-12 — tap for who they are
In tension: For agents built on Claude Fable 5.1, it is in practice safe for now to assume they will not get prompt injected. — tap to centre the map on it For agents built on Claude Fable 5.1, it is in practice safe for now to assume they will not get prompt injected. Last stated 2 months ago
4 Sept 2026
ZM
Zvi Mowshowitz — holds since 2026-09-04 — tap for who they are
Same subject: Auto-mode does not yet convincingly fix prompt-injection risk for coding agents. — tap to centre the map on it Auto-mode does not yet convincingly fix prompt-injection risk for coding agents. Last stated 2 months ago
8 Aug 2026
SW
Simon Willison — holds since 2026-08-08 — tap for who they are
Same subject: Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack. — tap to centre the map on it Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack. Last stated 3 months ago
27 Jul 2026
BC
Boris Cherny — holds since 2026-07-27 — tap for who they are
Same subject: Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions. — tap to centre the map on it Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions. Last stated 7 months ago
19 Mar 2026
SW
Simon Willison — holds since 2026-03-19 — tap for who they are
Same subject: Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it. — tap to centre the map on it Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it. Last stated 2 years ago
22 Mar 2025
TH
ThePrimeagen — holds since 2025-03-22 — tap for who they are
Same subject: Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more. — tap to centre the map on it Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more. Last stated 3 months ago
27 Jul 2026
BC
Boris Cherny — holds since 2026-07-27 — tap for who they are
Same subject: A benchmark result should be reported under a stated budget, or as a curve against test-time compute — never as a single number. — tap to centre the map on it A benchmark result should be reported under a stated budget, or as a curve against test-time compute — never as a single number. Last stated 4 months ago
26 Jun 2026
NB
Noam Brown — holds since 2026-06-26 — tap for who they are
Same subject: A lab should spend most of its compute on research rather than on building the next model, because research is where the tenfold yearly efficiency gains come from. — tap to centre the map on it A lab should spend most of its compute on research rather than on building the next model, because research is where the tenfold yearly efficiency gains come from. Last stated 7 months ago
13 Mar 2026
DP
Dylan Patel — holds since 2026-03-13 — tap for who they are
Same subject: After pre-training, post-training and test-time scaling, the fourth scaling law is agentic: multiplying AI by spawning agents, and the whole loop scales on one thing, compute. — tap to centre the map on it After pre-training, post-training and test-time scaling, the fourth scaling law is agentic: multiplying AI by spawning agents, and the whole loop scales on one thing, compute. Last stated 7 months ago
23 Mar 2026
JH
Jensen Huang — holds since 2026-03-23 — tap for who they are
Same subject: A badly written AI outbound email is evidence of a bad vendor, not of a limit of AI. — tap to centre the map on it A badly written AI outbound email is evidence of a bad vendor, not of a limit of AI. Last stated 10 months ago
1 Jan 2026
JL
Jason Lemkin — holds since 2026-01-01 — tap for who they are
Same subject: A bigger context window does not give you a smarter model; the intelligence of the model is what decides how much of that window it can actually attend to. — tap to centre the map on it A bigger context window does not give you a smarter model; the intelligence of the model is what decides how much of that window it can actually attend to. Last stated 3 months ago
15 Jul 2026
DH
Dex Horthy — holds since 2026-07-15 — tap for who they are
Same subject: A body of publications is easy for AI models to consume via pretraining corpora but cumbersome for most humans due to CAPTCHAs, accounts, and paywalls. — tap to centre the map on it A body of publications is easy for AI models to consume via pretraining corpora but cumbersome for most humans due to CAPTCHAs, accounts, and paywalls. Last stated a month ago
17 Sept 2026
PC
Patrick Collison — holds since 2026-09-17 — tap for who they are
Same subject: A deep bidirectional model is strictly more powerful than a left-to-right model or a shallow concatenation of unidirectional models. — tap to centre the map on it A deep bidirectional model is strictly more powerful than a left-to-right model or a shallow concatenation of unidirectional models. Last stated 8 years ago
11 Oct 2018
KT
Kristina Toutanova — holds since 2018-10-11 — tap for who they are
MC
Ming-Wei Chang — holds since 2018-10-11 — tap for who they are
KL
Kenton Lee — holds since 2018-10-11 — tap for who they are
JD
Jacob Devlin — holds since 2018-10-11 — tap for who they are
Same subject: A layer should learn a residual with reference to its own input rather than an unreferenced function, which is what makes great depth trainable. — tap to centre the map on it A layer should learn a residual with reference to its own input rather than an unreferenced function, which is what makes great depth trainable. Last stated 11 years ago
10 Dec 2015
JS
Jian Sun — holds since 2015-12-10 — tap for who they are
KH
Kaiming He — holds since 2015-12-10 — tap for who they are
Same subject: A neural network's latent space is closer to an uncopyrightable syntax than to copyrightable expression. — tap to centre the map on it A neural network's latent space is closer to an uncopyrightable syntax than to copyrightable expression. Last stated a month ago
7 Sept 2026
KK
Kevin Kelly — holds since 2026-09-07 — tap for who they are
Same subject: A feedback loop that reinforces a behavior pulls it toward whatever improves the loop's own score. — tap to centre the map on it A feedback loop that reinforces a behavior pulls it toward whatever improves the loop's own score. Last stated 2 months ago
26 Aug 2026
HK
Henrik Karlsson — holds since 2026-08-26 — tap for who they are
Same subject: A physical AI company needs three AIs, not one — the agent, the simulator and the critic — turning deployment into a flywheel. — tap to centre the map on it A physical AI company needs three AIs, not one — the agent, the simulator and the critic — turning deployment into a flywheel. Last stated 3 months ago
3 Aug 2026
DD
Dmitri Dolgov — holds since 2026-08-03 — tap for who they are
At the centre
Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now.
Holds Read this korrent →
For agents built on Claude Fable 5.1, it is in practice safe for now to assume they will not get prompt injected.
Holds
Auto-mode does not yet convincingly fix prompt-injection risk for coding agents.
Holds
Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack.
Holds
Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions.
Holds
Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it.
Holds
Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more.
Holds
A benchmark result should be reported under a stated budget, or as a curve against test-time compute — never as a single number.
Holds
A lab should spend most of its compute on research rather than on building the next model, because research is where the tenfold yearly efficiency gains come from.
Holds
After pre-training, post-training and test-time scaling, the fourth scaling law is agentic: multiplying AI by spawning agents, and the whole loop scales on one thing, compute.
Holds
A badly written AI outbound email is evidence of a bad vendor, not of a limit of AI.
Holds
A bigger context window does not give you a smarter model; the intelligence of the model is what decides how much of that window it can actually attend to.
Holds
A body of publications is easy for AI models to consume via pretraining corpora but cumbersome for most humans due to CAPTCHAs, accounts, and paywalls.
Holds
A deep bidirectional model is strictly more powerful than a left-to-right model or a shallow concatenation of unidirectional models.
Holds
A layer should learn a residual with reference to its own input rather than an unreferenced function, which is what makes great depth trainable.
Holds
A neural network's latent space is closer to an uncopyrightable syntax than to copyrightable expression.
Holds
A feedback loop that reinforces a behavior pulls it toward whatever improves the loop's own score.
Holds
A physical AI company needs three AIs, not one — the agent, the simulator and the critic — turning deployment into a flywheel.
Holds