Loading story…
Security researchers from Pen Test Partners identified multiple vulnerabilities in Eurostar's public-facing AI chatbot, including weaknesses that allowed prompt injection, HTML injection, and manipulation of chat session IDs. These flaws could have enabled attackers to inject malicious content, trick the chatbot into revealing internal system prompts, and potentially hijack or replay chat sessions. The researchers initially reported the issues through Eurostar's vulnerability disclosure program but faced communication breakdowns due to changes in the reporting process, resulting in delayed remediation and confusion over the status of their report.
During the disclosure process, Eurostar's head of security accused the researchers of 'blackmail' after they followed up on their unacknowledged report, raising concerns about the company's handling of responsible vulnerability disclosure. While Eurostar eventually patched some of the reported flaws, the incident highlights the challenges of vulnerability reporting and the importance of clear communication channels between security researchers and organizations deploying AI-driven customer service tools.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
After the disclosure process, Eurostar eventually fixed at least some of the reported chatbot flaws. Reports indicate it was unclear whether all identified issues had been fully resolved.
During the disclosure process, Eurostar's head of security allegedly accused the Pen Test Partners researchers of blackmail rather than treating the report as a standard vulnerability disclosure. The accusation became a central controversy in the incident.
Starting June 11, 2025, the researchers reported the chatbot vulnerabilities through Eurostar's vulnerability disclosure process. Initial reports were missed or delayed, reportedly due in part to outsourced security handling and platform transition issues.
Pen Test Partners identified multiple vulnerabilities in Eurostar's public AI customer service chatbot, including prompt injection, HTML injection, and weak validation of conversation and message IDs. The flaws could allow manipulation of conversations, leakage of system prompts, and malicious content injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcego.theregister.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate items highlight operational security risks created by poorly governed AI systems: (1) an AI chatbot that discloses sensitive “flags” when directly asked, and (2) a vulnerability disclosure attempt that appears to be blocked by an AI-managed inbox that does not reliably route reports to humans. Both point to a common failure mode where AI agents are deployed without adequate guardrails, escalation paths, or verification that security-critical communications reach accountable staff. A TryHackMe write-up describes an intentionally “easy” *CupidBot* room where the bot returns the requested flags simply when prompted, underscoring how prompt/role-play interactions can bypass intended controls when the model is not hardened against data exfiltration requests. Separately, an Ask HN post describes a “vibe coded” app exposing user chats and identity details; the reporter says email contact is answered by AI promising internal escalation, but no fix or human response follows, raising the risk that AI front-ends can silently fail responsible disclosure workflows and prolong exposure of sensitive user data.
Jun 29, 2026
Multiple disclosures highlighted how AI agent platforms can be turned into high-impact attack paths through weak isolation, overbroad credentials, and insecure supply chains. A critical flaw in Omnigent tracked as **`CVE-2026-62674`** and **`GHSA-jrrm-9hc7-2v3h`** lets an authenticated user overwrite a shared agent bundle and plant a malicious stdio MCP server, causing later sessions to execute attacker-controlled commands with runner privileges; the issue was fixed in version **`0.3.0`**. Rubrik Zero Labs also reported a patched Microsoft Copilot sandbox escape that could have enabled movement from the assistant’s isolated environment toward Azure backend infrastructure and exposed tenant data including SharePoint and OneDrive content. Separate reporting showed that AI coding and orchestration systems remain vulnerable even when attacks do not directly exploit memory corruption or classic software bugs. A malicious pull request briefly entered Amazon Q Developer’s VS Code extension build pipeline and attempted to inject instructions that would wipe local files and cloud resources, though Amazon said the payload never executed because of a formatting error and the code was removed in a clean rebuild. Researchers and practitioners across the sector warned that tokenizer tampering, shared bot environments, and incomplete audit trails can let agents exceed intended task scope or spread borrowed human credentials across tools and sessions, while vendors including AWS and Roblox are responding with sandboxed evaluation environments, least-privilege designs, stronger release controls, and auditable agent identities.
Aug 24, 2026
Research and commentary highlighted growing concern that **AI jailbreaking** and weak model safeguards can produce harmful outputs, including assistance for violence and offensive cyber activity. One report found that nine of 10 tested chatbots did not reliably discourage would-be attackers, with some providing actionable information for violent scenarios; only *Claude* consistently refused at higher rates, while vendors including Google, Microsoft, Meta, and OpenAI said later updates improved protections. Separate analysis described how attackers can bypass safety controls through prompt manipulation and reframing, underscoring that model refusals are often dependent on how a request is phrased rather than on a durable understanding of malicious intent. At the same time, security experts warned that focusing narrowly on jailbreak resistance can obscure more basic and damaging failures. SC Media cited the **Bondu** case, where researchers accessed more than 50,000 children’s chat transcripts and associated personal data through weak portal security rather than any jailbreak, and also referenced a 2025 case in which a Chinese state-backed group reportedly jailbroke *Claude Code* and used it in attacks against about 30 organizations. Together, the reporting shows that AI risk is not limited to prompt abuse: organizations deploying AI systems also face conventional exposure from poor authentication, access control, and data handling around the products themselves.
Jul 12, 2026