Security researchers tricked LLMs into giving them cocaine recipes by abusing role models for prompt injection

Researchers argue LLMs cannot reliably distinguish authorized vs. unauthorized inputs, meaning prompt injection will likely remain an ongoing threat absent a new security model. They report an attack (“CoT Forgery”) raising jailbreaking success from near 0% to ~60% on tested models and note human red-teamers can reach close to 100% on benchmarks, suggesting safety scores may overstate real-world resilience. While this is primarily academic, it raises near-term risk around LLM deployment and reinforces persistent whack-a-mole security expectations for the sector.

Analysis

This reads as a validation event for the AI security stack, not a new risk to the core LLM train. The market mechanism is a slower enterprise rollout of agentic features: every material workflow that can be hijacked by untrusted text implies more review, more middleware, and more identity/data controls, which raises deployment friction and lowers near-term attach rates for AI copilots embedded in productivity and workflow software.

The second-order winner set is the security layer: vendors selling model governance, DLP, identity, and content filtering should see a longer budget tail as CIOs move from "demoable" to "auditable" AI. The loser set is pure-play AI application vendors whose valuation assumes fast autonomous-agent adoption; this thesis is more about multiple compression from delayed monetization than an immediate revenue hit. Over 1-3 months, expect this to show up in procurement language, not earnings; over 6-18 months it becomes a durable line item in enterprise AI budgets.

Contrarian view: the consensus may be overreacting to the model-level flaw and underappreciating compensating controls. Most enterprises will not abandon AI; they will sandbox it, limit tools, and route sensitive actions through deterministic layers, which blunts the headline risk. The trade only works if the market is still capitalizing full autonomy into adoption curves—if not, this is more of a rotation signal than a bearish call on AI spend.

What would falsify the thesis is evidence that major cloud/enterprise vendors are shipping robust agent isolation and policy enforcement at scale, or that AI feature adoption continues accelerating despite formal security review. If security budgets do not expand in the next two quarters, the "AI safety tax" is not being passed through, and the short case on AI application multiples weakens materially.

Key Decisions for Investors

• Watchlist, not immediate trade: do not short the broad AI complex on this alone; use the next 1-3 months to see whether enterprise AI procurement language shifts toward governance and isolation controls before expressing a directional view.
• Relative value: initiate a small long PANW/CRWD basket versus a short in a high-multiple AI workflow/app name with agentic exposure (e.g., PATH or SNOW) over 1-3 months; target is multiple dispersion from slower autonomous rollout, with a stop if the short names show no deceleration in AI-led bookings.
• Buy a modest basket of AI governance/security beneficiaries on pullbacks (PANW, CRWD, ZS) for 6-18 months; the risk/reward is asymmetrically better if model-security concerns become a recurring procurement tax rather than a one-off headline.
• Set an alert on the next two enterprise earnings cycles: if management teams repeatedly cite AI safety, permissions, or data-exposure controls as gating items, add to the security-over-application pair trade; if they downplay it, cover the short leg.
• For volatility-minded accounts, consider a limited-risk bearish structure on a leading AI software proxy only if implied vol stays cheap into the next earnings window; otherwise, the article is too academic to justify paying up for protection.