I never got too far with prompt injection, but one thing I wonder is if you overload the llm, repeatedly over context, repeatedly over its context trimming tricks buffer … can it fail open?