The bot watches the mempool, sees your pending buy, and submits its own buy with a higher priority-fee so it lands first. Your trade then executes at the elevated price, and the bot's sell lands immediately after, capturing the move you created.
Your slippage-tolerance is the bot's budget. Setting 15% on a thin pool tells it that anything up to 15% of your order is available to take, and it will take close to all of it. Small swaps are often ignored because gas costs exceed the prize; large swaps on shallow pools are the profitable targets.
Defences that work: tight tolerance, splitting large orders over time, routing through a private-mempool so the trade never sits in public view, and trading pairs deep enough that the attack is not worth the gas. On chains with a single sequencer and no public queue, the attack surface differs but does not vanish.
Related: mev, slippage-tolerance, private-mempool, front-running-onchain