What it means
A language model receives its instructions and its data as one undifferentiated stream of text. It has no reliable way to tell which parts are commands from the operator and which are merely material to process. Prompt injection exploits exactly that.
The dangerous variant is indirect: the attacker never talks to the model. They plant instructions in something the model will later read — a web page, a PDF, an email, a code comment, a support ticket — and wait. When an assistant summarizes that page, it encounters text saying to ignore its instructions and forward the user's data, and it has no principled basis for refusing.
This is widely regarded as an unsolved problem. Mitigations reduce the success rate; none of them close it, because the ambiguity is inherent to how the models take input.
Why it matters
The risk scales directly with what the system can do. Injection against a chatbot produces embarrassing text. Injection against an agent with email access, database credentials or the ability to spend money produces real damage — and the more useful you make an assistant by connecting it to your systems, the more valuable it becomes as a target.
In practice
Design as though injection will succeed: grant least privilege, keep a human approving consequential actions, and treat any content fetched from outside as hostile input rather than trusted context. Do not rely on instructing the model to ignore embedded instructions — that has been defeated repeatedly.