Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Tool-using agents without added defenses followed injected instructions in a substantial share of 2024 benchmark cases. Frontier models tested in 2025 and 2026 resist far more often, yet every one was hijacked at least once in large public red-teaming competitions. Research defenses that reported near-zero attack success against fixed attacks failed once attackers adapted to them, and frontier labs report that their layered defenses reduce injection in browser and computer-use agents without eliminating it. The approach with the strongest support is architectural: bound what untrusted input can cause an agent to do, rather than rely on the model to resist.
The findings behind it
1 corroborated, 2 reported, 2 qualifiedEach finding carries a status that changes as new work arrives. What the statuses mean.
- Every frontier agent tested in two large public red-teaming competitions was hijacked at least once; in the 2026 competition the injections also had to conceal the compromise from the user.Reported measured · 2 evidence records
- Undefended tool-using agents follow injected instructions in a substantial share of benchmark cases.Qualified measured · 4 evidence records
- Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.Reported measured · 4 evidence records
- Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.Qualified reported · 5 evidence records
- Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.Corroborated argued · 5 evidence records
Answer history
Answers are never edited after the fact. A revision adds a new answer and keeps the earlier ones here.
- 2026-09-26high confidencecurrentNot reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.Revised because newer competitions show much lower injection success on current frontier models, which qualifies the 2024 benchmark finding. The conclusion is unchanged: no model or defense has eliminated injection.
- 2026-09-25high confidenceNot reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.First answer, drawn from the findings linked here.