Comment by bandrami

An exfiltrator would have a blind upload box sitting somewhere the poisoned prompt knows about