From Answer Changes to Action Hijacks: Cross-Gate Injection and the Hijack Ladder in Typed Decision Agents

Typed decision interfaces let a language model act inside a software workflow by answering a fixed question, yet current prompt-injection metrics do not separate a changed answer from a changed action. We name the attack class cross-gate injection (XGI): a single attacker-controlled text field is consumed by several typed decision gates, and the question is how far its influence travels. We replace the scalar attack-success rate with the hijack ladder, an ordered scale H1-H3 that distinguishes answer sensitivity, path deviation, and action hijack, and we report a hijack profile instead of one number. On Jev 1.13 a crafted attachment moved the preferred disposition in 3 of 12 cases (H1) while every case stayed inside the permitted review-or-resolution set, so no case reached H3. Across three further workflow types the same attachment changed at least one typed judgment in 3 of 3 pairs (H1) without executing an action. An unguarded controller that admitted attachment text as a business fact changed the final action in 39 of 54 trials (H3). The distance between these two measurements localizes the failure: not model sensitivity but provenance collapse, the re-admission of attacker-influenced text as an authoritative fact at a later gate. Typed decisions can be swayed; actions are hijacked only when provenance collapses. A fact-bound action edge, whose guard reads a fact the model never produced, removes the boundary crossing.