Beyond Prompt Injection: When AI Systems Are Bent