Bug Bounty Researcher Recreates Retail AI Chatbot Flaw Using DNS Exfiltration
· 23:17 · Watch on YouTube ↗
Summary
A bug bounty researcher recreates an AI retail chatbot flaw in a lab, showing how a business-context prompt can misuse a domain-lookup tool to send a protected promo code in a DNS subdomain. He says the original finding earned about $8,000.
Key points
- Guest Ads says the demonstration is based on a bug he reported through an unnamed major retailer's public bug-bounty program; he reports a bounty of about $8,000.
- The lab recreates an e-commerce chatbot with a protected promo code and different challenge levels that vary the model and guardrails.
- The researchers probed the chatbot's system prompt and tool behavior after direct requests for the discount were refused.
- A business-context pretext induced the chatbot to use a domain-lookup function; the promo code was exposed in a DNS subdomain sent to a callback server.
- Ads says front-end sanitization blocked markdown and HTML approaches, while the weakness involved a business-relevant tool call and application logic.
- The demonstration's security lesson is to assess what AI agents' tools can do and whether routine functions such as domain lookup could expose sensitive data; the lab behavior persisted despite stronger guardrails.
Article Details
- Topics
- [00:36] Simulated retailer chatbot challenge: obtaining a discount code without enough account balance.
- [03:32] Probing chatbot prompts and tool capabilities to find a way to access the code.
- [07:31] DNS callback setup and disclosure of the promo code through a subdomain lookup.
- [09:24] Reported retailer bug bounty and business-logic flaw despite front-end sanitization.
- [11:09] Medium-level lab: using a developer and integration pretext to prompt agent domain lookups.
- [19:03] Lessons on semantic prompt framing, social-engineering the model, and reviewing agent tools.