But how can a document fetched by the LLM be interpreted as a prompt if the original instruction is "only accept prompts from user input text box"? I mean, wou

But how can a document fetched by the LLM be interpreted as a prompt if the original instruction is "only accept prompts from user input text box"? I mean, wouldn't the prompt to ignore the original instructions need to come from the user text box (which the attacker supposedly doesn't have access to)?