Direct injection: the attacker is the user
Direct prompt injection is the more intuitive case: a user types something straight into the chat interface, deliberately trying to override the system prompt or make the model ignore its stated rules. This overlaps heavily with what people mean by 'jailbreaking.' The attacker and the end user are the same person, they have direct access to the input field, and the goal is usually to get the model to produce content or behavior it was instructed not to produce, bypass a content policy, reveal a hidden system prompt, or act outside its intended role.
Direct injection is annoying and can cause reputational or policy problems, but on its own, with a model that has no tools and no access to anything beyond the conversation, the blast radius is limited to the conversation itself. The model might say something it shouldn't, but it can't do anything it shouldn't, because there's nothing for it to do. That limitation is exactly what changes in the next lesson.