The model draws no distinction between what you say to it and what it reads. If you ask for a summary of an incoming letter, the text of that letter can behave as an instruction in exactly the way your request does. It is not you who has to be fooled, it is the model — and a web page, an email or a CV is enough for that.
This is not a theoretical risk. In the documented cases the carrier was always something a company receives every day: an incoming email, a support ticket, a web form, an image. No break-in was needed. And it has a price: in a 2026 survey of 602 breached organisations, a data breach involving prompt injection cost an average of 5.89 million dollars.
The most common misconception is that a prompt can fix it. It cannot be fixed with a prompt, and there is no complete solution to it either — the best research groups say so themselves. What measurably helps is layered defence, and above all making sure that a hijacked model cannot do much.
The basic mechanism is walked through in Prompt Injection: When Someone Hijacks Your Instruction, a separate article. Directly related terms: least privilege, jailbreak and OWASP LLM Top 10.