Prompt injection is role confusion, and your MCP gateway can't see it

There is a paper that reframes prompt injection in a way that is hard to unsee: Prompt Injection as Role Confusion. Its claim is that the dozens of named attacks (ignore previous instructions, hidden HTML, markdown injection, tool injection, RAG injection) are not different bugs. They are one bug: a