One question to ask on every AI product call

11-06-2026 aisecurity

Next time you’re on a marketing call for an AI product, ask this: “How do you plan on separating data from instructions?”

No vendor I’m aware of will have a clean answer. Prompt injection — where user-supplied data hijacks the model’s instruction layer — is the SQL injection of the LLM era, and most “AI-powered” products are shipping with the equivalent of raw string concatenation.

— Felix