A fundamental flaw leaves LLMs strikingly vulnerable to attack