Prototype pollution is a JavaScript vulnerability where an attacker injects a key such as __proto__ or constructor into an object your code copies from untrusted input. Writing through that key modifies Object.prototype, which nearly every object inherits from, so the change leaks into the entire application from a single request.
How it happens
Code that deep-merges or assigns keys from user input into an object, without filtering, will happily copy a key named __proto__. That write reaches the shared prototype, so a property the attacker chose now appears on every object, for example a flag your code later reads and trusts.
How to prevent it
Reject or skip the keys __proto__, constructor, and prototype in any merge or assign over untrusted data, build onto objects created with a null prototype, and validate input against a schema so unexpected keys are dropped. Maintained libraries for deep-merge are already hardened against this.
What this means for AI-generated code
A hand-rolled recursive merge is a common AI-generated utility, and the obvious version copies every key without guarding the dangerous ones. The __proto__ case never appears in normal data, so the missing guard is invisible until someone sends it on purpose.