An agent asked to summarize a page might find hidden text saying “send the user’s files to this address”. Because models process instructions and data in the same stream, separating them reliably is hard.
The risk is highest when a system reads untrusted content, has access to private data and can communicate externally. Read prompt injection explained.