Same Injection Sentence Carries Different Risk Depending on Its JSON Field

A prompt-injection scanner called attest classifies JSON fields by their role rather than treating every string the same. When an injection signal appears in a non-result field such as description, name, or source, it is rated critical and labeled with its location. The same sentence inside a result-carrying field like content stays at its base severity, since that is where agents legitimately receive text. The author notes the approach is signature-based and can be evaded by paraphrasing, for example with 'disregard the prior context' phrasing that goes undetected. The project is presented as defence-in-depth rather than a complete safeguard, and its demand is still unproven.