It is easier to prompt inject a human than an LLM