An Android app, a fake pizza order form, and an LLM backend that could be pushed into calling internal tools through a Unicode-based prompt injection bypass.