When the content gives the orders.
An agent follows instructions. If it reads text containing instructions (a web page, a file, an issue), it may follow those too. That's prompt injection.
Where it hides
Web pages the agent reads
Files and documents you download
Issues and pull requests from strangers
Emails and tickets
Results from tools and MCP servers
Four Defences
Deny secrets
Block reading .env in settings.
Watch network
Question any unexpected download or upload.
Trusted tools
Only connect MCP servers you trust.
Separate
Read untrusted content in a locked-down session.
Source: OWASP Top 10 for LLM Applications ↗
Treat what it reads as data, never as orders.