“Prompt-based defenses, which involve adding instructions to a system prompt to prevent malicious behavior, are the least effective method for securing AI systems, a fact known since early 2023.”