Security teams handle AI vulnerabilities the way they handle every other kind: find it, score it, patch it, verify the fix. That sequence assumes the thing you found is a defect, an error in implementation that a correction removes. For the AI vulnerabilities that matter most, the assumption is wrong. The weakness is not in the implementation. It is in the design, and the design is the point. You cannot patch a property.
The clearest evidence sits at the top of every list. Prompt injection ranks first on the OWASP Top 10 for LLM Applications, and over the past year the people closest to it have stopped describing it as a bug awaiting a fix. Speaking at Infosecurity Europe 2026, an OWASP contributor characterized prompt injection as an unsolved architectural problem, rooted in the fact that a language model reads system instructions, user input, and retrieved content as a single undifferentiated stream of tokens with no built-in boundary between them (Infosecurity Magazine, 2026). The UK’s National Cyber Security Centre reached the same conclusion in late 2025, and when OpenAI shipped a hardened browser mode in February, it conceded that the underlying problem “may never be fully patched” (OpenAI, 2026). When the vendor tells you the patch is not coming, the patch is not coming.
A Defect Is Not a Property
Prompt injection is not an exception. It is the clearest instance of a category. A traditional vulnerability is the gap between what software was supposed to do and what it actually does. A model that follows an instruction buried inside a document it was asked to summarize is not failing at its job. It is doing its job. The same holds for the model that returns a confident falsehood, the classifier that collapses under a slightly perturbed input, and the system that surrenders fragments of its training data through ordinary use. None of these are malfunctions in systems that learn from data, interpret natural language, and act on probabilities. They are characteristics of systems that do those things (Carnegie Mellon SEI, 2026).
That distinction is the whole discipline, because not every AI vulnerability is irreducible, and treating them all alike produces two opposite failures. Three categories have to be told apart.
- Remediable defects – genuine implementation flaws with a real fix: an unauthenticated inference endpoint, a vector store exposed to the internet, a hardcoded key, an unpatched dependency in the serving stack. Conventional vulnerability management works here, and there is no excuse for leaving these open.
- Irreducible properties – weaknesses inherent to how the model operates: prompt injection, jailbreaks, hallucination, adversarial brittleness, training-data leakage. No patch removes them. They can only be bounded.
- Compound exposures – weaknesses that emerge from composition, when a model is wired to tools, data, and other agents. An injection that used to produce a bad answer becomes data exfiltration once the model can read inboxes and call APIs (OWASP, 2025).
Treat a property like a defect and the budget disappears chasing a patch that will never ship. Treat a defect like a property and something closable in an afternoon gets waved off as the cost of doing AI. The first failure is expensive. The second is negligent.
Autonomy Raised the Stakes Without Changing the Fix
The sorting can no longer wait, because the irreducible category became more dangerous without becoming any more fixable. A prompt injection that produced an embarrassing chatbot reply was a property an enterprise could tolerate. The same property, wired into an agent that books travel, moves money, or queries a customer database, is a remote-action vulnerability carrying CVSS scores above nine and measured attack success rates exceeding eight in ten against agentic systems (Vectra AI, 2026). EchoLeak, the first confirmed zero-click prompt-injection exploit against a production LLM system, demonstrated that the theoretical turned operational with no fix shipped in between (Aharon et al., 2025). Autonomy did not introduce a new vulnerability. It widened the blast radius of an old one.
Containment Is the Discipline
When a weakness cannot be removed, the work shifts from eliminating it to containing it, and containment is a different discipline with a different vocabulary. It means assuming the injection will land and limiting what it can reach: scoping a model’s tools and data to least privilege, gating high-consequence actions behind deterministic checks the model cannot argue its way past, separating untrusted content from privileged instructions at the architecture level rather than trusting the model to keep them apart, and instrumenting the system so that any action taken under a successful injection is both detectable and reversible. OWASP’s own guidance now points this way, treating filter and guardrail models as one layer beside deterministic controls rather than a remedy on their own (OWASP, 2025). The control that counts is the one the model cannot override.
This is where the difference between a guardrail and a constraint earns its keep. A guardrail is a behavior the model is asked to exhibit, and anything that can be asked of a model can be talked out of it. A constraint is a boundary enforced outside the model, in the orchestration and authorization layer, where natural-language persuasion has nothing to grip. Properties live inside the model. Control has to live outside it. The vulnerabilities with no patch are governed at the layer an attacker’s words cannot reach, or they are not governed at all.
The catalog of AI vulnerabilities will keep growing, and most new entries will keep arriving with no patch attached, because the capability and the exposure are the same property viewed from two sides. The mature program is not the one that closes the most findings. It is the one that knows which findings can be closed, contains the ones that cannot, and can show the containment held. Find-and-patch was never the whole of security. For AI, it is the smaller half.
References
Aharon, A., et al. (2025). EchoLeak: The first real-world zero-click prompt injection exploit in a production LLM system. arXiv.
Carnegie Mellon Software Engineering Institute. (2026). Weaknesses and vulnerabilities in modern AI: Why security and safety are so challenging.
Infosecurity Magazine. (2026). Prompt injection remains unsolved, OWASP researcher warns (Infosecurity Europe 2026).
OpenAI. (2026, February 13). Introducing Lockdown Mode for ChatGPT.
OWASP. (2025). OWASP Top 10 for LLM Applications 2025 (LLM01:2025, Prompt Injection) and LLM Prompt Injection Prevention Cheat Sheet.
Vectra AI. (2026). Prompt injection: Types, real-world CVEs, and enterprise defenses.
