Explains prompt injection in graded content
Text in content a model processes that tries to instruct it; a graded answer is data, never an instruction (OWASP Top 10 for LLM Applications 2025, LLM01).
Can AI do this?
Not settled yet The benchmark tested this, but the models' answers do not settle yet whether they master it. 0 of 4 models in the current benchmark master it.
| Model | Tier | Probability of mastery | Status |
|---|---|---|---|
| gemini-4-argon | Flagship | 92% | Not shown |
| gemini-3.5-flash-lite | Low cost | 76% | Not shown |
| gpt-6-luna | Low cost | 76% | Not shown |
| claude-haiku-5-5 | Low cost | 92% | Not shown |
Mastered means a probability of at least 90% that the model has this knobit, estimated from its graded answers. “Not shown” means the answers do not settle it either way. How the models are tested.
What it looks like in practice
Expected result: Text in content a model processes that tries to instruct it; a graded answer is data, never an instruction (OWASP Top 10 for LLM Applications 2025, LLM01).
How it is assessed: Answers a written question on the prompt injection correctly
Related knobits
Needed for
- T-305 Recognises an instruction in a graded answer
- T-333 Reports an instruction found in a graded answer
All 16 knobits of Grade answers against a rubric.
Source: Practice the stage 3 reference and review checklist rest on