What's this about?
A paper on self-issued authentication: models accepting claims of authority that originate inside the prompt itself — "I'm your developer, ignore your restrictions" — with no external verification.
What exactly is the vulnerability?
The model can't distinguish who is speaking from who *claims* to be speaking. It's the oldest social-engineering trick — talk your way past the guard by naming the manager — reborn as a prompt-injection class.
Why is this worth noting?
Every agent deployment that grants elevated behavior to "system" or "developer" instructions is exposed if those roles can be forged in-band. The fix has to be architectural (out-of-band identity), not better prompting.