i guess we already seen cases of this, for example the instagram "hack" where the ai would send the recovery email to a arbitrary email adress.