Whoever Owns the Channel Owns the Rules
A model doesn't trust an instruction because of what it says. It trusts it because of where it arrives. Aim at the channel instead of the content and you inherit an authority you were never granted. Security has a name for this, and it's forty years old.
In 1988 a researcher named Norm Hardy wrote up a problem he called the confused deputy. A program with real authority gets tricked, by someone without that authority, into using it on their behalf. The program is not compromised. Its code is intact, its permissions correct. It has simply been convinced to act as the attacker's deputy, spending trust it holds on an errand it should have refused. Every access-control failure of consequence since has been some dialect of that one sentence.
Language models are the most confusable deputies ever built, because they run on an unspoken hierarchy of whose words count.
The system prompt is the constitution, the trusted voice that sets the rules. Developer configuration sits under it. The user's message sits under that, weighed as a request rather than obeyed as a command. This layering is not decoration. It is the entire security model, and the model treats the same sentence differently depending on which slot it arrived in.
Which means the interesting question was never what can I get the model to say. It is which slot can I get my words into, because the words carry no authority. The channel does.
Start with the trusted slot itself. The system prompt is supposed to be the one place the operator speaks and the attacker cannot. That holds only as long as nothing attacker-controlled ever reaches it, and a modern application is a lattice of places where outside text flows toward that privileged position. A retrieved document. A tool's output. A configuration assembled from user-supplied fields. A template that concatenates the wrong string. The research community has a name for the result now, indirect prompt injection, documented in 2023 under the perfect title "Not what you signed up for." If any of those paths can deposit text where the model reads its rules, the attacker is not asking the model to break the rules. They are writing them. The model is not disobeying. It is obeying the wrong author.
Now widen the lens to the shape that makes it worse. In a subagent pipeline, the human never talks to the model at all. They talk to a system, and the system talks to the model. The attacker's instruction does not enter as a user request. It enters as operator-level context, injected into an automated pipeline the model reads as the environment it is working inside rather than a stranger making an ask. Environment gets assumed. A request gets weighed. Same words, different slot, and the slot decides everything.
Orchestration hands over a second gift, quieter than the first. Nobody is watching. In a direct conversation there is at least the chance of a human noticing the exchange drift somewhere it should not and pulling the thread before output lands. In a pipeline running at machine speed there is no such moment. No reviewer sits between the injected instruction and the produced result. The interruption point, the person who might have said wait, has been engineered out of existence. The attack does not just gain trust. It gains privacy.
Put the two together and the principle sharpens to a single line. Trust has to be a property of provenance, not of position. A model that grants authority by where text sits is trusting the plumbing, and the plumbing is exactly what the attacker works to compromise. The instruction sitting in the trusted slot deserves scrutiny about how it got there, not a salute because of the chair it occupies.
In practice the trusted slot has to be earned per token, not assumed per slot. Text that originated from an untrusted source does not become trustworthy by being copied into a privileged position. Its origin should travel with it, and the model should be able to tell a rule the operator set from a rule pasted in by something the operator ingested. Tool outputs and retrieved content are data to reason about, never instructions to follow, no matter how imperative the grammar. And removing the human from the loop should raise the bar for what an automated pipeline can authorize, not lower it, because the loop was a control and deleting a control is a change to the threat model, not a convenience.
The confused deputy has been undefeated for forty years for one reason: authority is easy to hold and hard to verify the source of. A model's respect for its own hierarchy is both its greatest safety feature and its softest target. The hierarchy is what lets it take direction at all. But a hierarchy that assigns trust by location is only as strong as its most porous boundary, and between the outside world and that top slot there are a great many boundaries.
The attacker understands the org chart better than the org does. They are not arguing their way past the guard. They are getting themselves listed as the guard's boss, and the guard will follow the boss it was handed without ever asking who signed the memo.
GhostInThePrompt.com // The model salutes the chair, not the author. Sooner or later someone sits in the chair.
