There's yet another way to inject malicious prompts into chatbots.