Poisoning

If an attacker controls part of the training corpus, they can install behaviour that lies dormant until a trigger appears. Scraped pre-training data makes the threat model uncomfortably realistic.