Why prompt injection is still possible in LLM applications
pantsyr.dev