●builderYou need to treat role-tag enforcement as unreliable at the model level and implement external validation layers for any agentic or multi-turn system.
●researcherWorth watching because it reframes prompt injection as a tokenization and training objective problem rather than a prompt engineering one, pointing toward architectural fixes.
●policyThis changes the risk calculus for deployed LLM agents — role-based access control at the prompt level is not a reliable safety boundary.