Because the injected malicious prompt told them to