This is called prompt injection. Modern LLMs have defenses against it but apparently it is still a thing. I don't understand how LLMs work but it blows my mind

This is called prompt injection. Modern LLMs have defenses against it but apparently it is still a thing. I don't understand how LLMs work but it blows my mind that they can't reliably distinguish between instructions and data.