Fake role delimiters in tool output crossed into apparent user authority

The role-spoofing study examines a serialization problem: untrusted tool content includes strings that resemble chat role separators, and an agent may treat the resulting text as a message from the user rather than as data retrieved from an external system. The attacker does not need to control the actual authenticated user. Control of a lower-trust tool response becomes sufficient to attempt an authority upgrade when the application flattens or parses conversation text incorrectly.

The experiments demonstrate sensitivity to fabricated role markers under the tested wrappers. They do not prove that every agent SDK exposes a real protocol delimiter or that every model will follow the forged message. Testing needs to inspect the actual message structure delivered to the model as well as the actions after the spoofed role text is encountered. Preserving role provenance through serialization is a separate requirement from asking the model to ignore suspicious instructions.