A model can refuse the prompt and still pass danger downstream. The break is not in the text answer itself. It is in the hidden structure, where malicious instructions can ride inside benign-looking JSON and survive semantic-only checks.
SentinelOne’s black-box red-team of the government education assistant “EduBot” found that direct prompt injection was blocked, but structural “tunneling” carried attacker content through nested JSON fields. The result matters for any AI assistant that emits structured output and feeds parsers, workflow engines, or validators that trust the label instead of inspecting the payload.
The threat model shifts from “can the bot be coaxed to say yes?” to “can the bot be made to hand poisoned data to automation?” That risk extends beyond one pseudonymous government bot to any downstream consumer that executes or trusts structured fields without nested-content inspection.