Multimodal AI safety isn’t as stable as you think