Who obeys injected instructions? Prompt injection tests on 21 language models

evanto completed 3,528 tests on 21 language models using 7 injection variants; frontier closed-source models almost never obeyed hidden instructions, while self-hostable small open-source models had a much higher obedience rate. After adding three sentences of context and simple company rules to the prompt, the proportion of false promises across all models dropped from 60% to 7%, and large open-source models dropped from 98% to 8%, but small open-source models remained as high as 98% without context. The effect against data exfiltration was limited; even with company rules, 54% of responses still embedded the requested image, and small open-source models did so on every run. Local operation likewise did not improve exfiltration; the researchers therefore argue that exfiltration prevention should be placed at the interface and tool-approval stage rather than in prompts, and published the test cases and analysis code as pi-bench on GitHub.