The flaw concerns how large language models (LLMs) distinguish user instructions from instructions given by the developer, or from text the model reads elsewhere. To keep track of who said what, chatbots use tags that separate text according to what researchers call “roles.” Anything the user types goes inside <user> tags, while the LLM’s replies go inside <assistant> tags. For example, many jailbreaks, cases where a user tricks a model into saying or doing things it shouldn’t, work by convincing the model to read <user> text as if it were <system> or <think> text. They found, for instance, that swapping the tags, say, replacing <think> tags with <user> tags, had almost no effect on how the LLM interpreted the text.