Simon Willison: Prompt Injection Is Fundamentally a 'Role Confusion' Problem
Simon Willison (simonwillison.net)·medium signal
In a June 22 post, Simon Willison highlights an academic write-up reframing prompt injection as 'role confusion' — defenses will stay brittle until LLMs develop genuine perception of who is speaking (system vs. user vs. tool output), and the more dangerous attacks subtly shift the model's state rather than issuing obvious commands. A useful mental model for builders hardening agent and MCP pipelines, and distinct from the recent 'destyling untrusted input' work.