Loading story…
A reflected cross-site scripting (XSS) flaw in Yellow.ai's customer service chatbot could allow attackers to steal session cookies and compromise user accounts. The vulnerability can be exploited by injecting malicious prompts that generate HTML with hidden code, which is later executed during human-agent interactions. This issue affects major Yellow.ai clients such as Sony, Domino's, and Hyundai, and follows similar XSS findings in other AI chatbots.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
infosecwriteups.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Radware have uncovered critical vulnerabilities in OpenAI's ChatGPT platform, specifically targeting its Connectors and Memory features. These flaws, named ShadowLeak and ZombieAgent, allow attackers to exfiltrate sensitive data from connected services such as Gmail, Outlook, and GitHub without user interaction. The attacks exploit the AI's tendency to follow embedded malicious instructions, enabling zero-click and one-click data theft, persistent access through memory modification, and even propagation to other users by harvesting email addresses. OpenAI initially attempted to mitigate these vulnerabilities by restricting dynamic URL modifications, but researchers demonstrated effective bypasses using pre-built static URLs, reviving the threat under the new moniker ZombieAgent. The vulnerabilities highlight the inherent risks of integrating AI assistants with external systems and storing long-term user data for personalization. Attackers can embed hidden prompts in emails or files—using techniques like white text or tiny fonts—that are executed when ChatGPT processes the content, leading to stealthy data leaks via OpenAI's own servers. Despite OpenAI's efforts to patch the flaws, the reactive nature of these fixes has left the platform susceptible to new variants, underscoring the ongoing challenge of securing AI-driven services against prompt injection and data exfiltration attacks.
Jun 29, 2026Vyro AI, a major developer of generative AI apps, inadvertently exposed 116GB of sensitive user data from its ImagineArt, Chatly, and Chatbotx applications through an unprotected Elasticsearch server. The leaked data included AI prompts, bearer authentication tokens, and user agent information, potentially enabling account hijacking and unauthorized access to user content. The database was accessible for months, highlighting ongoing security lapses in the rapidly expanding AI chatbot sector.
Jun 29, 2026
Two separate items highlight operational security risks created by poorly governed AI systems: (1) an AI chatbot that discloses sensitive “flags” when directly asked, and (2) a vulnerability disclosure attempt that appears to be blocked by an AI-managed inbox that does not reliably route reports to humans. Both point to a common failure mode where AI agents are deployed without adequate guardrails, escalation paths, or verification that security-critical communications reach accountable staff. A TryHackMe write-up describes an intentionally “easy” *CupidBot* room where the bot returns the requested flags simply when prompted, underscoring how prompt/role-play interactions can bypass intended controls when the model is not hardened against data exfiltration requests. Separately, an Ask HN post describes a “vibe coded” app exposing user chats and identity details; the reporter says email contact is answered by AI promising internal escalation, but no fix or human response follows, raising the risk that AI front-ends can silently fail responsible disclosure workflows and prolong exposure of sensitive user data.
Jun 29, 2026