Comment by FatalLogic

Isn't this a general class of problem that has a similar risk profile for any type of gateway that accepts inputs that are not very tightly bounded?

Not only LLM services.