Instructions and data share one channel
Classic injection vulnerabilities, like SQL injection, exist because a program fails to keep code and data separate. A SQL engine expects a query string, and if user input gets concatenated into that string without escaping, attacker-supplied text can be interpreted as a command instead of a value. The fix is structural: parameterized queries give the database a way to receive data that is never, under any circumstances, parsed as code. Once you separate the channels properly, the vulnerability class is essentially closed.
Large language models don't have that separation available to them. A system prompt, a user's message, and the contents of a document the agent just fetched all arrive as the same kind of thing: plain text tokens in a single context window. The model has no low-level mechanism that marks one span of tokens as 'trusted instruction' and another as 'inert data,' the way a SQL parser marks a bound parameter as inert. It reads everything and does its best, statistically, to figure out what's an instruction and what's content to act on. That inference is exactly what an attacker can manipulate.