In-Band Signaling

In early telephony, commands and voice shared the same line. A 2600 Hz tone whistled into the mouthpiece was indistinguishable from the exchange's own signalling, and the network obeyed — it had no way of knowing who had spoken. The fix was not filtering tones: it was separating signalling from conversation into different channels.

A model's context has the same flaw. System instructions, user requests, tool output, file contents — all arrive as text in the same window. Anyone who controls any part of that text can write in the imperative.

There is no 2600 Hz tone to ban. The separation has to happen outside the channel, by where the text came from, never by what it looks like.