prompt injection in user generated content is the attack I worry about most

if users can put text into your system and the model reads it, they can try to steer the model. comments, profiles, uploads, all of it is a potential payload. treat it as hostile.