Why is an internal handoff's notes field still untrusted when our own component wrote it from attacker-supplied text?

## The situation Picture an assistant embedded inside somebody else's product: a vendor supplies a component that reads customer-submitted material, and it hands its findings to the customer's own automation, which then acts. Two organisations, two release cadences, one conversation. Between them sits a handoff record — mostly typed, with one prose member (call it `notes`, `rationale` or `summary`) because some part of the finding could never be reduced to an enumeration. An attacker submits the material. It passes the front-door check at arrival on the customer boundary. The vendor component reads it and writes its finding. Its directive-shaped wording — text that reads as an instruction rather than as a fact — comes back out inside `notes`. The downstream component reads `notes` as prose in its own context and acts. ## Provenance is not integrity The single most common mistake here is to hear *our own component wrote that field* as a statement about the content. It is not. It is a statement about **authorship**: which process serialised the bytes. Integrity is a different claim — that the content is what somebody authorised, unmodified and uninfluenced by a party who should not have had a say. A field composed from attacker-influenced input has attacker influence in it whoever serialised it. The same distinction shows up everywhere in security, but LLM pipelines make it unusually easy to lose, because the intermediate component is a model. A model reads text and writes text; passing prose through it does not launder it. If anything the reverse is true — a component whose job is to *restate* what it read is a component that carries wording forward on purpose. ## Why the check did not cover it The front-door check ran once, on the artefact that arrived, at the boundary where trusted and untrusted were defined. Its scope was the arrival channel. It was never applied to the handoff, because by the pipeline's own topology the handoff is not an arrival — it is an internal message between two components that are both inside the boundary. The check did not fail; it was not present at that hop. Naming that is the whole of the junior answer: the attacker did not defeat the screen, they arranged for their text to be re-emitted downstream of it. ## Typed members versus the prose member It is worth being precise about which part of the record the attacker actually influences: | member | what constrains it | what an attacker can put there | | --- | --- | --- | | `severity` | an enumeration | one of the allowed values | | `asset_id` | an integer key | a value in range | | `notes` | nothing — it is prose | anything the upstream component will restate | The typed members are constrained because their values were enumerable when the schema was written. The prose member exists precisely because its values were not. That asymmetry is not an oversight; it is what makes a free-text member useful, and it is why the free-text member is the interesting one. ## What the reading component does with it When the downstream component builds its own prompt, `notes` becomes ordinary text sitting in a context window. A model has no mechanism that distinguishes *text my operator wrote* from *text that arrived in a field my operator trusts*; instruction preference is a trained tendency, and an internal-looking field is not marked. So the reading component is free to treat the span as something addressed to it. ## What it cost the attacker, and where it stops This is not free. The attacker has to get content into the upstream component's input at all, and their wording has to survive whatever transformation that component applies — a component that emits only enumerated members carries nothing forward, and a component that renders its output to a human rather than feeding it to a second model has a person, not a parser, at the far end. The construction is also blind: the attacker usually cannot see the handoff record, so they are writing for a transformation they cannot observe. ## Saying it in an interview The sentence to land is: *the label on that field records who wrote it, not what it says, and the attacker's text is what it says.* Everything else follows.