Prompt-injection detectors often fail on **cross-prompt-injection attacks (XPIA)**, where the adversarial instruction is hidden inside a document, email, webpage, or tool output. This paper argues that the failure is not only a **distribution-shift problem**, but also a **representation-level problem**. Inside the hidden states of frozen detector backbones, user prompt-injection attacks (UPIA) and XPIA are encoded along **distinct, weakly aligned directions**. A detector whose readout is primarily aligned with the UPIA direction can therefore miss the XPIA signal, even though both signals are present in the same model’s representation. A **two-axis linear-discriminant probe** recovers this missing signal: UPIA attacks fire the UPIA axis in **99.9%** of caught cases, while XPIA attacks fire the XPIA axis in **97.3%** of caught cases. Axis ablations and activation-level steering suggest that these directions are not only predictive but may also be behaviorally relevant under controlled perturbations. The geometry persists across model families, training stages, scales, and external prompt-injection benchmarks, suggesting that **XPIA should be treated as a distinct threat axis rather than as a harder version of UPIA**.