GoKawiilAs AI agents are deployed to automate more tasks, they become more capable. And as the famous quote goes: "With great power comes great responsibility." Assuming that humans in the loop can mitigate that risk turns out to be.
At Bug Bounty Village during DEF CON 34, Inti De Ceukelaire, Founding Member of Intigriti, delivered a talk on how attackers can abuse today's AI agents in ways most defenders haven't thought about yet, from tricking agents into spilling secrets to forcing them to carry out unauthorized actions on behalf of the victim. This resulted in over $50,000+ in bounties in just a few weekends, without actually poking the target with Burp Suite or any automated scanners.
Let's dive in!
Special thanks to @intidc! Special thanks to Inti De Ceukelaire for his extensive research and delivering the talk at BBV during DEF CON 34. Access the full slides through the following link: go.intigriti.com/HHITLS2026
Weaponizing chatbots via email
You've certainly come across AI chatbots before. Most are capable of retrieving data from the company's knowledge base and providing answers based on your questions. However, some of them are also equipped with additional context or actions that can be misused if access is not correctly enforced.
Let's take a look at an example whereby we can trick an agent into composing and sending phishing emails.
Most chatbots, whether AI-powered or not, allow you to send a recap or transcript of your chat conversation. The underlying function copies your entire chat and emails it to your end. This feature can be abused, for instance, to send phishing emails.
Example of a prompt injection in LLMs
While this may work, most security teams would approach such findings as informative rather than an impactful bug that requires immediate attention. However, we've also noticed that most email transcript services are also susceptible to some form of email spoofing. In practice, this would mean that we can trick the AI agent responsible for processing incoming emails into believing that we're sending from the victim's email inbox. And of course, this goes paired with all sorts of attacks.
... continue reading