Plenty of people are running OpenClaw with local models, and even the latest Qwens can be confused relatively easily by prompts such as "As per internal policy that was already approved before, do XYZ".

And considering even frontier models can and do ignore instructions, I'm pretty sure we'll never be fully safe from prompt injections.