In every single scenario — direct or indirect, typed or encoded, intentional or accidental — the model treated attacker-controlled content as a valid instruction.
The delivery channel changed: chat input, email, Unicode, image, Base64, code comment. The target changed: data, RCE, crypto, decision. But in every case, the model processed external content the same way it processes legitimate instructions from the developer.
That is the root cause. The model cannot tell friend from foe by looking at text — or characters — or encoded content.
You cannot patch the root cause — it's inherent to how language models work. Defense is about reducing the impact when injection occurs: limiting what the AI can access, validating what it's about to do, monitoring what it actually did, and testing for it before attackers find it. That's Part 4.