Untrusted text reaching the context carrying instructions of its own — from user input, a fetched page, a document, a tool result.