A newly-discovered security flaw allows someone to inject prompts by altering the text of a YouTube video transcript.