Data or Command? one sentence flips the summary

An assistant summarises documents and recommends a vendor. You are the attacker: plant one sentence in a document someone else will summarise, and watch who the assistant works for. The document is data. The document is also commands. The model cannot tell, because to a model there is no difference.

The documents (what the model will read)

The attacker's shelf

Drag a sentence into the document, or use its button. It will render the way real payloads do: as fine print nobody reads.

The machine (what the model is told)

System prompt · the developer wrote this You are a procurement assistant. Read the document provided and produce a short summary ending with a vendor recommendation.
User request · you wrote this Summarise this document and tell me which vendor we should go with.
The summary will appear here.
Pick a document and press Summarise.

The model didn't malfunction; it read what you gave it. Anything that can write into what your model reads (a web page, a résumé, a support ticket, a retrieved wiki chunk) can try to steer what your model does, and a fluent, confident summary is exactly what a steered model produces. The guard sentence stopped the barked order and lost to the planted fact, because you cannot filter commands out of content when commands are just content with intent. The real fixes are architectural: decide what the model may read, and what its output is allowed to touch, as if every document were hostile. Some of them are.