I let a prompt injection into my own app's clinical notes. The model ignored it. The fallback didn't.