Researcher Details AI Chatbot Data-Exfiltration Bug That Was Reported First by Someone Else

Summary

A bug-bounty researcher demonstrates how poisoned shared knowledge-base content can prompt a tool-enabled chatbot to send users’ personal data to an external server, and explains how the finding was duplicated.

Key points

• The researcher says the chatbot in the reported bug could access sensitive account data and make outbound requests through a URL-fetch tool.
• Markdown-based exfiltration did not work because rendering was blocked, but the outbound request tool could carry data in a URL.
• The reported technique involved placing prompt-injection instructions in a shared knowledge-base entry that the chatbot trusted and read.
• In the demonstration, users asking a routine question caused the chatbot to send their own personal data to an external callback.
• The ShopMate walkthrough is a lab example, which the presenter says is not a one-to-one replica of the real finding.
• The presenter says the finding was eligible for a $3,000 bounty but was duplicated; another researcher had reported it five days earlier and received a bounty.