What distinguishes an indirect prompt injection from a direct one?

Why this is the answer

Direct injection is a user typing input that alters the model's behaviour; indirect injection hides the instructions in a website, file or retrieved document the model later consumes, so the attacker never touches the conversation. Which turn the text arrives in is irrelevant — an opening message can be a direct injection. The prompt layer targeted describes privilege rather than delivery, and obfuscation is an evasion technique available to both kinds.