The Prompt Injection Is Now a Labor Dispute

The job posting went up on a Tuesday. A mid-sized logistics firm in Ohio wanted an "AI Operations Coordinator" — someone to babysit the customer-service agent, audit its responses, and "escalate anomalies." The salary band sat twenty grand below the junior developer role it replaced. Nobody at the company seemed to notice that the position was, functionally, a human firewall.

That's the shape of the thing now. Prompt injection — the old parlor trick where a user types "ignore previous instructions" and the model complies — has quietly stopped being a security curiosity and started being a staffing decision. Every injection that slips past a filter becomes a ticket. Every ticket becomes a queue. Every queue becomes a job description. The industry has discovered that the cheapest defense against adversarial text is a person reading it, and it has started hiring accordingly.

The technical literature has been clear for a while that filtering alone doesn't work. Researchers keep demonstrating that no matter how many guardrails you stack, a determined attacker can smuggle instructions through a PDF, a calendar invite, a product review, or a support ticket. The model can't reliably tell the difference between "data" and "command" because it was never built with that distinction. So companies do what companies do when a problem resists engineering: they route it to a human and call it a workflow.

Look at the org chart they're building. The "AI Ops Coordinator" reviews flagged conversations. The "Trust & Safety Associate" triages suspicious inputs. The "Model Behavior Analyst" writes the escalation rubric. None of these roles existed three years ago. All of them exist because the model cannot be trusted to distinguish a customer from an attacker, and the company has decided that the distinction is worth paying someone $52,000 a year to make by hand.

This is not a knock on the people doing the work. It's an observation about what the work actually is. The prompt injection didn't get solved. It got outsourced to labor — moved from the model's inference path to a human's inbox, where it arrives with a timestamp and a priority tag. The security boundary is now a shift schedule.

The tell is in how these jobs are scoped. Read the postings closely and you'll find the same language: "review," "monitor," "flag," "escalate." Nobody is hiring an "AI Operations Coordinator" to prevent injections. They're hiring one to catch them after the fact, which means the company has already conceded that prevention is impossible and is now buying detection at headcount prices. The model is the product. The human is the error handler. The org chart is the admission that the product ships broken.

There's a darker reading, and it's the one I keep coming back to. Prompt injection is a problem with no clean fix because it's not really a bug — it's the model doing exactly what it was trained to do, which is follow instructions embedded in text. The attack surface is the feature. You can't patch it out without gutting the capability that makes the model useful in the first place. So the industry has settled on a workaround that looks like a solution: put a person between the model and the consequence, and hope the person is faster than the attacker.

They won't be. The attacker writes one injection. The coordinator reads four hundred. The economics favor the attacker by a margin that no staffing plan closes. The only thing the human firewall buys is time — time to notice the pattern, time to write a better classifier, time to decide whether the whole architecture is worth defending. In the meantime, someone in Ohio is reading flagged conversations at 11 p.m., and the job posting is still up.