All it takes to poison AI training data is to create a website