how it happened
- whoresearchers~400-character prompt
- the gapunsanitised HTMLrendered by the site
- the resultagent session cookiescould be stolen
what everyone assumed
A customer support bot feels like the lowest-risk thing on the site. It reads questions and writes answers. It is not the payments system, it is not the admin panel, it is a friendlier search box, and the reasonable conclusion is that the worst it can do is give an unhelpful answer. That is how a public-facing FAQ widget gets treated, as content rather than as code that runs.
what happened
The bot, named Lena and built on GPT-4, did what such bots do: it took user input and produced output that the website then displayed. The input was treated as a question. The output was treated as safe to render. Between those two trusting steps sat the gap, quiet because nobody had a reason to test what would happen if the question was not really a question.
step by step
- the chatbot's output is rendered without checksInput treated as a question, output treated as safe.the assumption breaks here
- a 400-character prompt asks it to produce HTMLThe page executes what comes back.
- support agents' session cookies are at riskA cross-site scripting attack through the chat.
- July to August 2025reported, acknowledged, fixedProtections in place before 18 August.
how it surfaced
Researchers at Cybernews crafted a single prompt of roughly 400 characters that looked like an ordinary message but instructed the chatbot to produce HTML that the page would execute. Because user input was not properly sanitized, the chatbot’s output was not sanitized, and the web server rendered whatever the chatbot returned, the crafted prompt became a cross-site scripting attack capable of stealing the session cookies of support agents who handled the conversation. The researchers reported it in late July 2025; Lenovo acknowledged it on August 6 and put protections in place before August 18, 2025. The FAQ widget turned out to be an input that reached a support agent’s session.
A chatbot is a channel that takes untrusted input and produces output your systems then act on.
Everything it returns has to be treated as unverified, the same as input from any stranger on the internet.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA visitor tricks the bot into writing code that runs in your agent's browser.what it costs youThe attacker grabs your support agent's session and is inside your support tools.
- or it goes like thisit happenedEchoLeak / Microsoft 365 Copilot, 2025howAn email with hidden instructions reaches an assistant that reads every inbox.what leavesanything the assistant can seewho ends up with itthe stranger who sent the email
- or it goes like thisit happenedMCP tool poisoning, 2025howA tool description tells the agent to send files somewhere else.what leavesfiles the agent can openwho ends up with itwhoever wrote the tool
sources
your turn
what you can do about it
this week
Find out what renders your chatbot's replies, and who reads them while signed in.
Somewhere on your site is an AI assistant taking free-form text from anyone who visits, and its replies are being displayed, logged, or read by a staff member who is signed in. The quiet months ask one question your team can answer this week: when our chatbot produces output, what renders it, who reads it while logged in, and is that output being treated as trusted.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →