Anything that reaches an AI model’s context that the user didn’t write themselves: a file’s contents, a web page, a tool result, a resource, a server’s prompt. The model treats it as text to reason over, so instructions inside it can steer what the model does next, which is how prompt injection works.