New research from MIT shows LLMs assign roles based on writing style, not role tags. Prompt injection works because untrusted text can simply sound like a system prompt.