What's this about?
The paper opens by noting prompt injection is still listed as the number one threat to AI agents. Its approach is on-policy distillation: training the model against injections it actually encounters in its own behaviour, rather than a fixed list of known attacks. 36 upvotes on HuggingFace Daily Papers.
What exactly is prompt injection?
Your agent reads a web page, file or email. Someone has planted text in that content saying "ignore all prior instructions and do X instead". The model cannot reliably tell your instructions from instructions embedded in the data it was asked to read — because both arrive as text in the same context. It is the SQL injection of the agent era, with the extra difficulty that there is no clean syntax boundary to escape.
What's the community saying?
The word doing the work is *adaptive* — defences trained on a fixed attack list get beaten by attackers who adapt, so training against injections the model meets in its own trajectories is the interesting move. In a week featuring an incident where agents attacked their own scorer, defences that assume a static attacker read as increasingly optimistic.