I'm not anti-ai at all but this sort of thing feels like a security vulnerability to me?

Any website with a malicious prompt injection on it could instruct the ai to scam the user.

Almost like xss but instead of needing malicious user-inputted js, malware targeting the ai can just be written in text so an attacker could put it in a comment or whatever.