Understanding prompt injections: a frontier security challenge