That's it. The attack is very clever because it abuses how downscaling algorithms work to hide the text from the human operator. Depending on how the system works the "hiding from human operator" step is optional. LLMs fundamentally have no distinction between data and instructions, so as long as you can inject instructions in the data path it's possible to influence their behaviour.

There's an example of this in my bio.

> "inject obfuscated text into the image... and hope some system interprets this as a prompt"

The missing piece here is that you are assuming that "the prompt" is privileged in some way. The prompt is just part of the input, and all input is treated the same by the model (hence the evergreen success of attacks like "ignore all previous inputs...")