You list the defences at the security review. Retrieved documents arrive wrapped in delimiters. The system prompt says to treat whatever is inside them as material and never as orders. A second model reads incoming text and scores how likely it is to be an attack. Three entries, and the slide looks like depth. Then somebody asks what each one is made of, and the three answers turn out to be the same sentence: a model reading text and judging what that text is. One paragraph good enough to get past the first gets past all three, in the same instant, for the same reason. You did not build three defences.

An orchard of one variety is one tree

A grower with three blocks of the same variety, on the same rootstock, ripening the same week, does not have three crops. He has one crop standing in three places. The disease that takes the first block is already suited to the second and reaches it within days. Nothing about the planting looks wrong until the season it shows up, and then the whole thing goes together. Anyone who has lived through that plants the next block differently: another variety, deeper roots, a later harvest, so that whatever ruins one has no particular reason to touch the other. The second variety is not chosen because it is better. It is chosen because it is unlike.

Defences against injection stack the same way, and the delimiter, the warning in the prompt and the scoring model are one variety planted three times. Each of them works only if a model reads text and correctly decides what kind of text it is, so the wording that beats one is close to the wording that beats the rest. Count them once. Then look for what is genuinely unlike them: a credential scoped so narrowly that the successful trick reaches nothing, an answer that ordinary code refuses to parse, an action suspended until a person clears it. Those fail too, for their own reasons — a scope granted too wide, a schema nobody updated, a reviewer on the fortieth approval of the morning. None of those reasons is that the paragraph was persuasive.

A smaller token beats a fourth filter

Watch what this changes in a real build. A retrieval assistant pulls in a repository document an attacker has edited. The content is carried as material rather than instruction, it cannot reach privileged functions on its own, the reply has to survive a structured validation written in code, and an attempt to send mail escalates to a human before anything leaves. Four controls, four different ways to be wrong, and only the first one is about recognising the trick.

That is also the budget argument. Every layer costs something — latency, friction, one more thing to keep working — so the useful number is not how many controls you have but how many failure modes they cover between them. A fourth model-based filter adds cost and almost no coverage. A token with fewer permissions on it adds coverage and no run-time cost at all. Believing that retrieval, fine-tuning or a well-drawn delimiter solves this by construction is how teams end up with a long list and one variety, and none of it removes a weakness that lives in how the model reads. It is mitigated, never closed.

A note from last week skips the door

The other way layers collapse is by all standing in the same doorway. Useful threat models pull the agent apart into the model, the harness, the tools, what it remembers, the environment it runs in and the protocols it speaks to other agents, because attacks land on input, on planning, on tool calls, on what gets stored and on the seams with ordinary software. Read a retrieval agent with a browser along three axes at once — a hostile document, exfiltration through the tool that makes web requests, memory quietly corrupted between sessions — and the three input filters do nothing for the last two. Text written into memory a week ago never passes an input check at all.

So the discipline is tracing one whole path, from the hostile sentence to the effect outside the machine, and asking what stands on that path and whether those things are unlike each other. Controls added without a named attack and a named impact are decoration. So is an adversarial test that only tries plain English, when the payload can be split across documents, hidden in an image, spoken, or written in another language. Depth is not the number of layers. Two defences that fall together were always one.