The LLM confusion is just the latest incarnation of the Confused Deputy problem. It's in the same class of vulnerabilities as CSRF.