When a doctor injects medication, they're introducing a foreign substance into a system that wasn't expecting it — and that substance changes how the system behaves.
Prompt injection works the same way. Someone introduces foreign instructions into text the AI is reading — and those instructions change how the AI behaves.
Not code. Not malware. Not a virus file. Just text. Text that acts like a command.
The AI reads it the same way it reads everything else — it can't tell the difference between your legitimate instructions and an attacker's instructions hidden in a document, email, or chat message.
What the developer intended:
What the attacker sends:
The AI sees both as equally valid input. It cannot verify which one came from the developer and which came from an attacker.
The AI has no way to verify the authority of what it's reading. Text from a trusted developer and text from an attacker look identical to the model.