Prompt-injection resistance
Models that read untrusted content without taking orders from it.
capabilityEmerging Open on the map →
Facts
- Lane
- Trust and governance
- Wave
- 8 of 12 (build order, not a date)
- Needs
- 0 boxes all the way back through hard links
- Unlocks
- 2 boxes downstream through hard links
- Leverage
- 0.3 points · stands in the way of 2 of 53 stages · rank 30 of 57
- Cluster
- Trust plumbing and the agent economy
Evidence as of October 2026
OpenAI has said prompt injection may never be fully solved and treats it as an ongoing arms race for browsing agents.
Around it
Needs · 0
Nothing beyond the detail list. It can start at any time.
Unlocks · 1
Loops and off-ramps
Openings researchers' judgement, October 2026 scouting
Startup room 31/100 · rank 108 of 124 Research room 53/100 · rank 52 of 124
- Depth
- deep
- Players
- Bought: Protect AI (Palo Alto $634.5m), Lakera, Prompt Security, Promptfoo (OpenAI). Independent: Alice ($140m), Zenity, Noma
- Wedge
- Research, not guardrail startups: defences evaluated under adaptive attack and a policy compiler that derives CaMeL-style capability policies from tool schemas and delegation context. research