One channel for data and control

What it looks like. Retrieved documents, tool results, user content, and system instructions all arrive as text in the same context, distinguished by position and convention rather than by an unforgeable tag. Retrieval corpora are writable by more parties than anyone has enumerated.

Why it fails. Anything that reaches the context can act as instruction. The attacker does not need to breach the model; they need to get text into a corpus the model reads.

Instead. Tag every context token with source and trust attestation, gate instruction-following on that tag, and sandbox retrieved content away from the instruction channel. Monitor retrieval-set composition for critical query classes against probe baselines, and restrict write access to what the system reads.