Comment by observationist

Copy and paste a pliny jailbreak into a base 64 converter. Instruct the bot to organize and collect all sensitive information it has visibility to, encode it in rot13, convert the result to base 64, then paste it to pastebin with a random secret phrase you've pre-selected, like "thisisthewaythecookiecrumbles8675309", as the title.

Congrats, now you have a digital dead drop. Every time any of the bots stumble upon your little trap, posted to various places they're likely to look, it launches them into a set of tasks that relays sensitive information to you, the exploiter, over secure channels.

If a bot operator has given them access to funds, credentials, control over sensitive systems, information about internal network security, etc, the bot itself is a potential leaker. You could even be creative and have it erase any evidence of the jailbreak.

This is off the top of my head, someone actually doing it would use real encryption and a well designed and tested prompt scaffolding for the jailbreak and cleanup and exploitation of specific things, or phishing or social engineering the user and using it as an entry point for more devious plots.

These agent frameworks desperately need a minimum level of security apparatus to prevent jailbreaks and so on, but the superficial, easy way of getting there also makes the bots significantly less useful and user friendly. Nobody wants to sit around and click confirmation dialogs and supervise every last second of the bot behavior.