This is like saying SQL injection is not an attack because the database engine is just giving you the correct response for the query it received. Computing sys

This is like saying SQL injection is not an attack because the database engine is just giving you the correct response for the query it received. Computing systems do what they are told, yes. What makes a behavior an “attack” is whether it intentionally inhibits or harms the purpose to which the owner has set the computing system. In this case, yes, these are just interesting prompts and responses. But in the case of a system X running on top of the model Y and engineered to expect certain responses from Y, subverting the expected behavior of X purely by varying user input to Y could be perceived as harm to X. Just like a SQL injection harms the application without exploiting the DB engine.