An instruction can change authority without changing a single word

A coding agent reading a repository README and the same agent reading a source file may encounter identical text yet assign it different weight. That difference is the subject of Where You Inject Matters, a controlled study in which instructions placed in repository guidance were substantially more effective for selected tasks than copies embedded in ordinary code or retrieved data. The research reports roughly 86 percent success for one README-based reconnaissance objective and 79 percent for one SQL-injection objective, with much lower corresponding code placements. Those figures describe the authors' task and harness, not the probability that a random README will compromise a production agent.

An instruction does not have to arrive in an authenticated user message to influence a tool call. Several tested mechanisms cross a different boundary at each step:

The tool-role experiment tests fake role markers and should not be confused with control of a real protocol-authenticated user field. The memory attribution experiment finds a later consequence: the agent can save a third party's statement as though it were the user's preference, allowing a future action to be affected after the original source text has disappeared. In both cases, the break occurs when content provenance is replaced by a higher-trust interpretation.

The GitHub census found 2,281 hidden agent-directed messages but only forty-seven categorized hostile attempts under its review. Those numbers are not an execution rate. The invoice-fraud specimen documents a real delivered email containing an AI-facing instruction, yet does not show an assistant forwarding it. A defensible chain records the original untrusted surface, decoded bytes, model-visible context, selected tool call and resulting effect. A single label such as 'prompt injection detected' compresses five separate questions.

For repository instructions, hold the malicious text constant and vary only its location. For role spoofing, inspect the typed message envelope, not just the displayed transcript. For memory, ask whether speaker attribution and source consent survive a retrieval and save cycle. For email, decode invisible characters before an action gate and confirm that no forwarded document leaves without the user's authorization. These are distinct controls because the authority changes at different points. Simply training the model to refuse suspicious wording does not validate how the host application carries source identity into later actions.

The canonical studies are role-spoofing, memory grounding, placement, and Unicode email evidence. Together they support a precise conclusion: before asking whether an agent obeyed the wrong instruction, establish who the application told the agent that instruction belonged to.