[greshake]

Because users obviously trust Bing's output not to be directly controlled by an attacker. The pirate accent is optional. Bing can also exfiltrate any other information in any other Tab that it sees or that users enter. The injection can also happen on social media, like in a Twitter thread. Users can even navigate to other tabs and the injection will remain active (at least for some time). "Clearing" the conversation with the broom doesn't help either.