Presumably threat actors are working on generic algorithms to optimise the production of images by the ML system such that they have the absolute worst affect on viewers of those images.

Optimising for minor effects like blindness to areas, up to major effects like epileptic seizures.