OpenAI Ships a Prompt-Injection Defense and Admits It Won't Stop the Attacks

01Apple spent two years behind on AI. Its plan is to rebuild Siri from scratch — again

Apple walks into WWDC on Monday with the worst AI track record of any company its size, and a counterintuitive read on what that means. According to The Verge, Apple plans to reintroduce the new Siri at the conference. Not for the first time. The company unveiled a rebuilt, more conversational Siri at WWDC the prior year, then quietly let it slip as the shipping date kept moving.

That earlier promise became the problem. Apple showed a Siri that could act across apps and understand personal context, marketed the feature, and then delayed it. The do-over now carries more weight than the original pitch, because the audience already heard the sales line once.

The framing inside the coverage is the unusual part. The Verge argues that playing from behind "might not be such a bad move." While rivals have spent two years insisting AI rewrites every product category, Apple has shipped Apple Intelligence in pieces and watched its assistant stall. That position lets it skip the maximalist claims and define Siri narrowly: an assistant that works, on a phone people already own.

Part of the rebuild may not be Apple's own work. The Verge's report points to Gemini, suggesting Apple could lean on an outside model to power the revamped assistant rather than ship entirely on its own foundation models. Apple has not confirmed the arrangement, and the detail sits in the reporting as a possibility, not a stated deal. If accurate, it would mark the company that built its brand on in-house silicon and on-device processing renting the core intelligence of its flagship feature.

TechCrunch frames Monday as Siri's "highly anticipated revamp," bundled with broader Apple Intelligence updates. The anticipation is the trap. Apple is selling the same feature a second time to a developer audience that watched the first version disappear from release notes, and the credibility cost of a second delay would land harder than the first.

What Apple controls is the install base. The assistant ships to over a billion active iPhones the moment it works, which is leverage no standalone AI product can match. That reach is also why the delays drew scrutiny no startup would attract. The next data point arrives Monday, when Apple either demos a shipping date or repeats a promise.

02The S&P 500 Won't Waive Its Profit Rule for SpaceX, and OpenAI and Anthropic Just Lost Their Shortcut

On June 4, S&P Dow Jones Indices declined to change its rules for SpaceX. The company had requested unusually fast entry into leading stock indexes as a condition of its planned market debut. After a monthlong consultation, the index managers said no.

The S&P 500 tracks the largest profitable US companies. SpaceX fails the profit test, and so would OpenAI and Anthropic. A waiver for Elon Musk's company could have opened the same door for both AI labs soon after their expected IPOs. That path is now closed.

Entry is valuable because of what follows it. Index membership triggers automatic buying from passive funds that hold much of the country's retirement savings. Inclusion would have routed billions toward SpaceX, and later the AI firms, no matter whether either reached profitability.

One line connects three otherwise separate stories. The most richly valued names in AI and space still lose money, so the machinery around public markets is rearranging itself rather than admitting them on the old terms.

Washington is pulling the other way. President Trump said this week he is discussing deals "where the American people can benefit from the success of AI," language his administration confirmed could extend to an equity stake in OpenAI. The index gatekeepers want distance from unprofitable AI risk. The government is weighing direct ownership of it.

Musk is avoiding the question altogether. According to The Verge, his route to SpaceX's debut sidesteps the conventional listing process that index inclusion normally rewards. Three of the sector's marquee companies are each meeting the same wall, and each is taking a different way around it: one rejected, one courted by the state, one bypassing Wall Street.

The next test is timing. OpenAI and Anthropic have signaled IPOs but no firm dates, and S&P's June 4 stance sets the bar they will clear or skip when they file.

03OpenAI's New Prompt-Injection Defense Ships With an Admission: It Won't Stop the Attacks

OpenAI now sells a fix for one of the AI agent's oldest weaknesses, and the fix comes pre-labeled as incomplete. The company unveiled Lockdown Mode, a setting meant to protect sensitive data when ChatGPT handles untrusted content. In the same breath, OpenAI says ChatGPT could still be vulnerable to prompt injections even with the mode turned on. The stated goal is narrower: reduce the likelihood that sensitive data leaks during an attack, not prevent the attack.

That framing puts a marketed defense next to an open admission of its limits. Lockdown Mode is positioned as a safeguard customers can switch on. What they switch on, by OpenAI's own description, lowers a probability rather than closing a hole.

The gap matters because the attack it targets is structural, not a bug in any one model. A prompt injection works when an agent reads attacker-controlled text and treats it as instructions. MIT Technology Review, analyzing a recent breach of Meta's AI customer support agent, argued there is more to AI security than the model itself. The point cuts against the idea that a better-defended model is the answer. An agent wired into email, accounts, or internal records inherits risk from every input it trusts, and the model is only one layer of that system.

For developers connecting agents to sensitive data, the choice is no longer whether a defense exists. It is how to deploy systems whose core risk vendors describe as reduced, not removed. That shifts the burden of containment back onto the people building on top: scoping permissions, isolating data, and assuming the agent can be turned against its operator.

Lockdown Mode does not resolve that. It narrows one failure path while OpenAI concedes others remain open. The next signal to watch is whether vendors keep pricing partial defenses as features, or whether buyers connecting agents to regulated data start demanding guarantees no current product offers.