It gets even worse when platforms blindly render img tags or the equivalent. Then no user interaction is required to exfil - just showing the image in the UI is enough.
LLM-based chatbots rarely have XSS holes. They allow a very strict subset of HTML to be displayed.
The problem is that just supporting images and links is enough to open up a private data exfiltration vector, due to the nature of prompt injection attacks.
I think this has it backwards, and actually applies to every safety and security procedure in any field.
Only the experts ever cared about or learned the lessons. The CEOs never learned anything about security; it's someone else's problem. So there was nothing for AI peddlers to forget, they just found a gap in the armor of the "burdensome regulations" and are currently cramming as much as possible through it before it's closed up.
Oh, and some supposed financial penalty is claimed, but never really followed up on to see where that money went, or what it accomplished/paid for - and nobody talks about the amount of money that's made by the Legal-man & Machine-owitz LLP Esq. that handles these situations, in a completely opaque manner (such as how much are the legal teams on both sides of the matter making on the 'scandal')?
CEOs aren't the reason supply chain attacks are absolutely rife with problems right now. That's entirely on the technical experts who created all of those pinnacle achievements in tech ranging from tech-led orgs and open source community built package ecosystems. Arbitrary code execution in homebrew, scoop, chocolatey, npm, expo, cocoapods, pip... you name it, it's got infected.
The LastPass data breach happened because _the_ alpha-geek in that building got sloppy and kept the keys to prod on their laptop _and_ got phised.
An employee (dev/sysadmin) had their home device compromised via a supply chain attack, which installed a keylogger and the attacker(s) were able to exfiltrate the credentials to lastpass cloud envs.
Another big still mostly open category is speculative execution data leaks or other "abstraction breaks" like Rowhammer.
At least in theory things like Passkeys and ubiquitous password manager use should eventually start to cut down on simple phishing attacks.
We've seen that one (now fixed) in ChatGPT, Google Bard, Writer.com, Amazon Q, Google NotebookLM and Google AI Studio.