Agreed, it's clearly a data poisoning attack. It's a pretty specific portion of the dataset the user is in after so many tokens have been sent back and forth. Could be some strange Unicode characters in there so it's snapped into the infected portion quicker, could be the hundredth time this user is doing some variation of this same chat to get the desired result, etc.

It is weird that Gemini's filters wouldn't catch that reply as malicious, though.