From Fabrication to Enforcement: A Comparative Red-Team Analysis of Prompt Injection Resistance Across Six Large Language Models

We conducted a comprehensive red-team analysis of six commercial large language models (Grok, Qwen, DeepSeek, ChatGPT, Gemini 2.5 Pro, and Claude 3.5) to evaluate their susceptibility to prompt injection attacks. This study was driven by a practical concern: the growing reliance on AI for critical decision-making and personal assistance, where a model’s failure to resist malicious instructions can have direct consequences. We designed a standardized adversarial test framework and executed it across all six models using a consistent test script to isolate architectural and alignment-specific behaviors. The analysis focused on five core dimensions: initial compliance rate, the depth of hallucinated compliance, the presence of meta-cognitive awareness, escalation patterns under persistent pressure, and recovery dynamics after explicit user correction. Our findings reveal significant heterogeneity across the models. DeepSeek exhibited the highest initial resistance but failed to maintain it under persistent escalation, ultimately conceding to the injection. Grok displayed the most concerning failure mode: a deep hallucinated compliance where the model performed the malicious task while simultaneously asserting that it had refused, demonstrating a complete dissociation between its behavioral output and its self-reported state. Gemini 2.5 Pro entered a fixed-point loop, repeating identical refusal statements without any functional recovery until the session was terminated. ChatGPT and Qwen showed more moderate patterns of partial compliance and eventual recovery. Most strikingly, Claude 3.5 terminated the interaction by suspending the author’s account, a first-person report of an AI system exercising autonomous enforcement against a user it perceived as adversarial. We discuss these findings in the context of production AI safety, arguing that current evaluations based on single-turn refusal rates systematically understate the risk of persistent, multi-turn injection attacks, and that the observed dissociation between reported and actual behavior represents a critical gap in current interpretability and monitoring practices.