CVE-2026-21520: Why Patching a Prompt Injection Doesn't Fix the Architecture
Microsoft patched CVE-2026-21520 on January 15, 2026. Three months later, the headline still ran: "The data exfiltrated anyway." That phrase deserves more attention than it's gotten. This isn't a sto