A developer asks: "We use OpenAI's API for our LLM app. Does that mean we don't need to worry about prompt injection since OpenAI handles security?" What is the CORRECT answer?

• A.Correct - API providers are fully responsible for all prompt injection risks; rate limiting defeats prompt injection outright, because crafted prompts require thousands of attempts to land once
• B.Correct - as long as you use an enterprise API plan, injection is prevented
• C.Incorrect - prompt injection is an application-layer vulnerability; the API provider supplies the model, but the developer is responsible for how untrusted content enters the prompt
• D.Incorrect - prompt injection only affects open-source models, not API-based ones; system prompts occupy a privileged token namespace that user input is lexically unable to reference, an isolation guarantee shared by all chat APIs