the attackers went straight for the rows the benchmark left blank

A systematisation paper out this week sorted a large corpus of prompt-injection templates into six classes of trick and then did the obvious thing nobody had done, which is check which classes the popular defence benchmarks actually contain. Two to four of the six, as it turns out. Then they looked at what adaptive attackers, people iterating against a live defence in a public challenge, reached for instead. Structural spoofing, the fake system message and the tool-shaped output, appeared in 76 per cent of their templates against 35 per cent in the curated sets. Obfuscation in 69 per cent against 5. The attackers were concentrating on precisely the rows the benchmark left blank. It is hard to call that a coincidence, and harder to call a passing score on the curated set a result. A defence has been measured against the attacks someone wrote down in advance, which is a different thing from being measured. So which classes is your red-team suite missing, and who else already knows?