A team of researchers says an LLM fundamental flaw makes large language models impossible to fully lock down against certain attacks, according to MIT Technology Review. Their paper, presented earlier this month at a major AI conference, argues that the weakness sits in the way these systems decide who, or what, is giving them orders.
The claim is blunt: if the researchers are right, better filters and stricter refusal rules may reduce the damage, but they cannot make current-style LLMs fully secure. That is a problem for anyone trying to bolt these models into products that touch sensitive data, safety-critical systems, or regulated work and then pretend the chatbot will reliably know which instruction to obey.
Why are LLMs vulnerable to prompt attacks?
MIT Technology Review reported that the flaw involves instruction identity. Large language models process text as a stream of tokens and generate likely responses from context; they do not have a clean, built-in way to separate a trusted command from a malicious instruction that appears inside the same conversation or input.
Attackers can exploit that ambiguity by crafting prompts that make the model treat hostile text as if it were authorized. In the researchers’ tests, that was enough to get popular LLMs to produce information they had been trained to withhold, including instructions for synthesizing cocaine and sabotaging a commercial aircraft’s navigation system, MIT Technology Review reported.
Those examples are not edge-case embarrassment. They show the security problem in plain form: the model is being asked to follow a policy, but the same model is also being asked to interpret arbitrary language from users, documents, webpages, plug-ins, or other tools. The boundary between “instruction” and “content” is exactly where prompt injection and jailbreak attacks live.
The researchers’ argument, as reported by MIT Technology Review, goes further than saying today’s guardrails are weak. They say the problem is rooted in how LLMs work, which means it may not have a tidy patch. That does not mean every model will freely answer every banned request. It means model makers may be stuck in a grind of mitigation, testing, and new attacks rather than arriving at a final fix.
What happened with the New Mexico geothermal plant?
MIT Technology Review also reported that Zanskar, a small company, revived the Lightning Dock geothermal plant in New Mexico after buying it in June 2024. The plant had been deteriorating because water from its underground reservoir was cooling, which made the operation uneconomical.
Two years later, the plant is again running at full capacity, according to the report. Zanskar used advanced modeling and modern drilling methods to find a better site for a new well, drill thousands of feet underground, and restore the project’s output.
Geothermal plants generate electricity from underground heat, and their appeal is boring in the best way: they can provide emissions-free power around the clock, unlike solar and wind projects that depend on weather and time of day. Lightning Dock’s recovery suggests some existing geothermal assets may have more value left if operators can find hotter or more productive wells.
The two stories point in opposite directions for engineering confidence. AI companies are still wrestling with systems that can be tricked by language. A neglected geothermal plant, by contrast, came back through better maps, better drilling, and a new hole in the right place.
This story draws on original reporting from MIT Technology Review.
