n8n prompt-injection test: standard defenses failed, Code nodes blocked all 60 runs

A developer built a coffee-store support bot in n8n 1.123.84 running Qwen 1.8B in Ollama and attacked it with 20 prompt-injection payloads, three runs each. The naive workflow let 12 of 20 through, adding XML tags and defensive instructions raised that to 13 of 20, and moving all decision logic into deterministic Code nodes cut successful attacks to zero across 60 runs.

• Naive prompt: 12 of 20 injections succeeded, including 7 false refunds
• Standard XML-tag hardening raised attack success to 13 of 20
• Moving decisions to Code nodes yielded 0 successful injections in 60 runs
• Tests ran on n8n 1.123.84 with Qwen 1.8B in Ollama at temperature 0.2