These breaches will continue for as long as nobody cares about security and everybody is infected with the LLM brainworm.
And honestly when you start looking at agentic systems that uses it's previous step to take future steps. The system has to some idea what you want to permit and don't want to permit as everyone could have different expectations here.
Sure. Now imagine this very scenario not limited by humans and scaling the way machines do. And then let us consider the current reality that an agentic system on the receiving end may have unlimited access because to too was vibed.
All you need is the untrusted content (or more generally vulnerable content since how you feel about the content doesn't matter) leg and something you care about to be attacked.
E.g. could be as simple as a prompt injection that causes your LLM to output a prompt injection that then gets inserted somewhere else.
Or without exfiltration rm -rf /
Or a social engineering attack.
So there are other bifectas and trifectas.