Could attackers use seemingly innocuous prompts to manipulate an AI system and even make it their unwitting ally?