A prompt is any text input the model receives. That includes what you type in a chat, what gets pulled from a document, what's retrieved from a database. The attacker's weapon is just text.
The model was set up to do one thing. The injection makes it do something different.
→ A chatbot meant to answer FAQ questions starts sending emails
→ A summarizer meant to condense articles starts leaking private data
→ A coding assistant starts revealing its system prompt
The developer didn't intend for this. The injection exploited the gap between what the developer told the model to do and what the model will actually do when it reads something unexpected.
A prompt injection vulnerability exists when someone can type something — or hide something in content the AI reads — that makes the AI behave in ways the developer never planned for.