My prompt-injection fix caught 0 of 20 attacks. The part I almost didn't build caught all of them.

Developer Vishal Habib shared his experience building a security checker for AI-generated retirement advice. The system uses code to verify numeric facts and LLM 'judges' to evaluate non-numeric content. During testing, Habib discovered that while his judges were resilient, the system lacked a mechanism to identify and label prompt-injection attacks, allowing malicious drafts to pass. He implemented a multi-layered defense, including strict 'fail-closed' logic and a regex filter. However, a second round of testing by a fresh red team showed the regex failed to catch any of the 20 new, obfuscated attacks. Ultimately, the system's success relied on instructing the LLM judges to treat all drafts as untrusted data rather than relying on brittle pattern matching. Habib emphasizes that developers must test whether their systems can explicitly name an attack, rather than simply assuming they are immune because they were not fooled.