It works because the AI finds and exploits the flaws in the prompt, as it has been trained to do.