Prompt injection is the confused deputy, with extra steps