Now I have to wonder how this works out with prompt injection? If you can target an audience with an ad that is inline with the chat/LLM, how hard would it be

Now I have to wonder how this works out with prompt injection? If you can target an audience with an ad that is inline with the chat/LLM, how hard would it be to have that ad inject a prompt that coerces it to trick the user into giving up financial info and exfiltrating that info via a web request to a website that the attacker owns? That's probably the worst case scenario but like you mentioned there's also plenty of danger in ads "poisoning" the chat to produce intentionally incorrect or biased responses.