This blog post explains it in detail, including the POC prompt injection hosted on the website: https://embracethered.com/blog/posts/2024/chatgpt-macos-app-...

Note that such a payload can come from anywhere, like a pdf document the user analyzes, an image, a spreadsheet, etc...