I'd say it's both. Models should be intelligent enough to be able to tell prompt injections apart. But the language itself is also novel and not in the model training data set, so that should be a good signal for intelligence in itself.