The AI landscape doesn't move in one direction — it lurches. Some techniques leap from experiment to table stakes in a single quarter; others stall against regulatory walls, technical ceilings, or organisational inertia that no amount of hype can dislodge. Knowing which is which is the hard part. The State of Play cuts through the noise with a rigorously maintained index of AI techniques across every major business domain — classified by maturity, evidenced by real-world adoption, and updated daily so you always know where you stand relative to the field. Stop guessing. Start knowing.
A daily newsletter distilling the past two weeks of movement in a domain or two — delivered to your inbox while the index updates in the background.
Each dot marks the weighted maturity of practices within a domain — hover for a brief summary, click for more detail
Defences against adversarial prompt injection and jailbreak attacks that attempt to bypass AI system guardrails. Includes input sanitisation and prompt security layers; distinct from general cybersecurity which protects infrastructure rather than AI-specific attack vectors.
Prompt injection and jailbreak defences are emerging security practices addressing adversarial attacks on Large Language Models. These attacks exploit the inherent flexibility of natural language interfaces, allowing attackers to override model instructions or extract sensitive information. Unlike output filtering (content safety), these defences focus on protecting the input layer—validating, sanitising, or detecting malicious prompts before they reach the model. By early 2024, the landscape had shifted from pure research toward production deployment: major cloud providers (Microsoft, AWS) began shipping defence tools, vendors like Lakera operationalised detection APIs, and the research community validated multiple defence approaches (fine-tuning, structured queries, cryptographic signing). Yet critical assessments persisted—security researchers continued to demonstrate guardrail evasions and attack transferability, suggesting that while effective against known patterns, no single solution remained fundamentally robust against adaptive adversaries.
By mid-April 2026, prompt injection and jailbreak defence exhibited operational maturity combined with deepening recognition of fundamental architectural limits. Market consolidation solidified through 2025-2026 with Check Point's integration of Lakera (completed September 2025), creating converged network and AI security capabilities. Lakera Guard maintained performance leadership with independently validated metrics: 98%+ detection rates, sub-50ms latency, <0.5% false positive rates across 100+ languages, with named Fortune 500 deployments (notably Dropbox) confirming production viability. Microsoft's expansion of Prompt Shields into Azure AI Foundry and Global Secure Access signalled major infrastructure vendor commitment to network-level integration. Systematic evidence from February 2026 survey of 128 academic studies documented attack methods evolution from simple direct injection to sophisticated multimodal approaches achieving >90% success, with defense mechanisms showing 95% effectiveness against known patterns but acknowledged gaps in standardized evaluation and limited robustness against novel vectors. March-April 2026 developments crystallized architectural understanding: peer-reviewed research established the "defense trilemma" proving fundamental mathematical impossibility of wrapper-based defenses achieving simultaneous continuity, utility preservation, and security; large-scale arena evaluation (464 participants, 272K attacks on 13 frontier models) revealed significant robustness variance (Claude Opus 0.5% vs Gemini 8.5% ASR) with intelligence uncorrelated to safety; empirical attack taxonomy demonstrated composite obfuscation+semantic attacks reaching 97.6% success against intent-aware defenses; real-world telemetry confirmed first documented indirect injection ad-review evasion with 22 active attack techniques in production; and inference-time jailbreak research exposed surgical removal of refusal patterns from model hidden states. Independent competitive assessments confirmed Lakera Guard and ProtectAI as best-in-class, though cost-scaling (pricing-per-call models) drove adoption toward open-source alternatives. Vectra AI and security researchers documented prompt injection as OWASP LLM01 with 50-84% attack success rates and critical CVEs (Microsoft Copilot CVSS 9.3, GitHub CVSS 9.6, Cursor CVSS 9.8). Industry consensus shifted toward acceptance that prompt injection is a structural problem requiring new LLM design paradigms rather than a solvable technical challenge through filters or wrappers. The practice remained operationally essential with multiple competing vendors, defense-in-depth best practices, and enterprise deployments, while technically unresolved against adaptive adversaries and exhibiting persistent architectural constraints—sustaining bleeding-edge classification through mid-2026.
— Brave research demonstrating indirect injection succeeds equally against cloud-hosted (Mozilla Tabstack) and on-device (Cotypist) systems, proving deployment model doesn't eliminate structural vulnerability.
— Novel 'Fake Context Alignment' attack bypassing Google's Feb 2026 mitigations via messaging notifications. Demonstrates context-shifting as critical risk; current architecture fundamentally flawed for multi-channel scenarios.
— Rigorous evaluation harness addressing systematic weaknesses in detector benchmarks (per-dataset tuning, undisclosed operating points) via cross-validation and global threshold selection—improves reproducibility of defense assessment.
— Reveals critical vulnerability gap: African language prompts achieve higher jailbreak success than English. Defenses are language-dependent; culturally adapted prompts reduce refusal rates—creates exploitable asymmetric surface.
— Variational inference framework for automated black-box jailbreak generation achieving competitive attack success with diversity and scalability. Shows attacker methodology evolution toward probabilistic, distributional frameworks.
— Novel memory-based jailbreak achieving 95% success under specific conditions in multi-turn systems. Documents emerging vulnerability class distinct from single-prompt attacks, exploiting conversation history degradation.
— Peer-reviewed ePCA formal verification framework achieving zero attack success and zero false positives on controlled scenarios—represents paradigm shift from probabilistic semantic guardrails to deterministic verification.
— CVE-2026-26030 (CVSS 9.9) in Microsoft Semantic Kernel: prompt injection escalates to RCE via model-generated lambda expressions. Reclassifies injection from output-integrity to execution-boundary problem.