I think he created an image with a prompt hidden. Such that if someone asks GPT to do any task with that image or document, it will inject the prompt which exfiltrates data.