This situation is negligence: the engineer who designed the system that interacts with random websites didn't account for the fact those interactions could be harmful? What kind of excuse is that.
The idea that running what appears to be an LLM assigned to random websites and told to interact with them possibly having negative side effects seems incredibly obvious.
Was the direction of the model not to enter data in forms? If it was, then this is incompatible with what we know about the general competency of these models. If it wasn't, then this type of thing ("we submitted fake data to a website") is a clear outcome of "interact with random websites."