Developer finds his own security test passed while the prompt injection attack still worked

On 26 July, software developer Karim Hamidou discovered a prompt-injection vulnerability in his open-source CLI tool llm-council, which chains multiple AI models to rank and synthesise answers. The tool used fixed, publicly visible delimiter strings to fence untrusted model output, meaning any model that had seen the repository could write the closing marker mid-response and escape the sandboxed block. More troublingly, a unit test already existed that claimed to verify this boundary could not be forged, yet the test only checked string positions and occurrence counts — never whether a downstream model could actually be deceived. The test passed consistently and contributed to 100% code coverage, masking the unfixed vulnerability entirely. The developer resolved the flaw by replacing the static delimiters with a per-run random nonce, making the closing marker unguessable to any voter model.