One of the tricky things is untrusted input somehow making its way into what is otherwise considered trusted input. There are obviously untrusted inputs like a

One of the tricky things is untrusted input somehow making its way into what is otherwise considered trusted input. There are obviously untrusted inputs like a customer support chatbot. And there are maybe trusted inputs, like a codebase that probably doesn't contain harmful instructions, but there's always a chance that harmful instructions might be able to make their way into it.