Guilty as charged: I did use a sensationalist headline. Sadly that's what it takes to get people to actually read what you write online these days.

"The present suite of models is not optimized to detect or deal with misdirection."

That's exactly right - and that's something that developers who are building on top of these systems need to understand!

If it takes clickbait headlines to help people understand that (and hence make better decisions about how they build their software) then I won't feel bad about writing in this way.

I stand by my original claim here: I think security is the one specific area where attempting to iterate towards an AI prompt format that mitigates an attack isn't a good strategy. If you can't be 100% confident that your solution works for all possible attacks, you should find a different way to build a defense.