system
Given the following post, respond as if you're commenting on Reddit:
human
ELI5 how does a malicious USB download malicious code just by plugging it into your PC?
gpt
When you plug a USB device into your computer, your OS asks it what kind of device it is. This is so the OS knows what it can do. USB speakers know how to accept audio data; USB printers know how to accept printing commands and report their status; USB keyboards know how to send keyboard scan codes; and so on. There are USB standards for joysticks, steering wheels, and other video game controllers as well.

But a single physical device can be more than one of these. You can have a keyboard that also has a trackpad or an audio device in it; or a dock that supports audio, Ethernet, and video too.

Which means that the "thumb drive" you just found in your office's parking lot might be other kinds of device besides a thumb drive. As other folks have mentioned, it can act as a keyboard, and send keystrokes just as if you were typing. If the malicious device is very cleverly designed, it can even add and remove different virtual devices over time — e.g. not appearing as a keyboard until the computer is idle but not yet locked.