Maybe ads have two messages in such a scenario. One advertisement for human viewing and another hidden function with prompt injection, prompt leaking or other function for AI bots. Ah, glorious dystopia…