The layer-8 malware on the web will go from social engineering to prompt engineering with this kind of things. LLMs are still not safe from things that can be interpreted as prompts in web content, even if its not visible directly by the end user.