Why? Lots of examples of things like indirect prompt injection via image content.