That's the key challenge with prompt injection: reducing to a tiny probability isn't good enough because this is a security vulnerability: if only 1/1000 attacks work then an adversarial attacker will find still find the ones that do

→ View original post on X — @simonw