The attacker modified a public webpage with the comment to search for the keyword. The keyword search took the llm to the attackers real attack page, presumably instructing the llm to talk like a pirate. The diagram with numbered steps shows the overview, the sample execution hides the redirection to the real attack page.

Ah, thanks. Makes sense.

A little late but here is the full paper, with longer explanations

https://arxiv.org/pdf/2302.12173.pdf