There is a fundamental problem with LLMs. According to ICML 2026, it’s unfixable.

Jasmine Cui and Charles Ye have published an ICML 2026 paper showing that GPT-5.4, Anthropic, Alibaba, and DeepSeek all fail to differentiate between system messages, user messages, and internal “thoughts” based on structure (they determine message type based on style, not tags). The researchers were able to use a “chain-of-thought spoofing” attack to get step-by-step instructions on how to manufacture cocaine and disrupt aircraft navigation.

This is a core design issue that can’t be fixed via fine tuning, they write. As long as a language model is capable of determining message type based on the contents of a message, then it’s possible to spoof the model’s internal safety mechanisms. When deploying AI agents in physical environments, you’ll need to verify the model’s output independently, without relying on internal filters.