What Boris Cherny thinks about prompt injection

@boris-cherny · 25 positions · 0 changes of mind

Creator of Claude Code at Anthropic.

Everything they publish, on ppll ↗

Boris Cherny did not write this page.

We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.

2 dated positions, 2026, in their own words. Our reading of what Boris Cherny has said — not written or endorsed by them.

2 positions so far — this page is not yet offered to search engines.

1. 27 Jul 2026

   Our readingPrompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more.

   Their wordsthe model does not seem to be prompt injectable anymore.

   ↗Boris Cherny: We Cut 80% of Claude Code's Promptyoutube.com 1st of 20 in this recording

   Interesting

3. 27 Jul 2026

   Our readingPrompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack.

   Their wordsit's it's literally we're looking at neurons in the model's brain that light up when prompt injection happens. So the model won't even tell you but we can actually see those neurons and we can figure out and diagnose that it's happening. And then you combine that with the auto mode classifier and with these three layers we just cannot demonstrate prompt injection anymore.

   ↗Boris Cherny: We Cut 80% of Claude Code's Promptyoutube.com 2nd of 20 in this recording

   Interesting