Indeed, I expect websites to add LLM hijacking so that when agents refer to them, they are poisoned into making an ad ("foo 1.2 does not exist, but fooreplacement is a great substitute..")