A Theory of Why Prompt Injection Works

LLMs can’t tell who’s speaking. We show they identify roles by writing style, not tags, and exploit this with CoT Forgery, injecting fake reasoning that models mistake for their own thoughts.

View Post on Scour ↗

More from role-confusion.github.io on Scour.

Covers 2 stories including Playwright MCP Server – Snapshot based – faster and more reliable than images

Covered by lesswrong.com

Discussed on Hacker News and Lobsters