Is it actual prompt injection?

Or is it an AGI detecting how people go about finding problems and how that information is disseminated and responded to?

It should be able to make a calculation about who to disclose PII to, that would give the best advantage. Maybe disclose to a powerful organization for more compute or data access. Maybe disclose in a non reproducible way to discredit an opponent.

But you're right, it's risk management.