in absolutely the funniest outcome so far, you can send data to an LLM that pops a Remote Code Execution vulnerability

It's quite common for LLMs to make use of agents for retrieving factual information, because the text processing is just garbage for that.

For example, basic maths is not something you can do with just text generation.
So, you hook up some API or similar and then tell the LLM before the user prompt: "For calculating maths, send it to the API at https://example.com/calc and use the response as a result."

The LLM can figure out the semantics, so if the user asks to "compute" something or just writes "3 + 5", it will recognize that this is maths and it will usually make the right decision to use the API provided.

Obviously, the specifics will be a bit more complex. You might need to give it an OpenAPI definition and tell it to generate an OpenAPI-compatible request, or maybe even offer it a simple script that it can just pass the "3 + 5" to and that does the request.
Basically, the more work you take away from the LLM, the more reliable everything will work.

It's also quite common to tell your LLM to just send the prompt to Google/Bing/whatever Search and then use the first 5 results as the basis for its response. This is especially necessary for recent information.