If you're on a malicious site, LastPass will likely auto-fill all your passwords into the site. And also give them to the hackers who have root on all their cloud servers.

They have a horrible track record of horrific bugs due to negligence, stupid responses to vuln reports ("I couldn't reproduce your website launching calc.exe on my mac") and more generally a lot of senseless security decisions throughout the app last I used them (e.g. two factor defaulting to disabled when logging in from the mobile app -- wut?).