Quick Summary
Pen Test Partners identified four security flaws in Eurostar’s AI chatbot that could allow attackers to inject malicious HTML or access sensitive information. After reporting these issues through the company’s vulnerability disclosure program, the researchers faced accusations of blackmail from Eurostar’s head of security. The incident highlights significant risks associated with chatbot security and the importance of effective vulnerability management.
The Securityish Brief
Researchers from Pen Test Partners discovered four vulnerabilities in Eurostar’s public AI chatbot, which could enable attackers to inject harmful HTML content or extract sensitive information. The issues were reported on June 11, 2025, but after a lack of response, further attempts to communicate led to accusations of blackmail from Eurostar’s head of security. This exchange raises concerns about the effectiveness of Eurostar’s vulnerability disclosure program and the potential for lost reports due to miscommunication.
The vulnerabilities stem from the chatbot’s design, where the entire chat history is sent to the API, but only the latest message undergoes security checks. This flaw allows earlier messages to be manipulated, leading to prompt injection attacks. For instance, a researcher successfully tricked the chatbot into revealing its internal system prompts and even generated HTML for reference links.
Additionally, the chatbot was found to be vulnerable to HTML injection, which could facilitate phishing attacks by returning malicious links disguised as legitimate responses. The backend system’s failure to verify conversation and message IDs further suggests a risk of stored cross-site scripting (XSS), which can compromise user sessions and data.
While Eurostar has patched some of the reported issues, the researchers are uncertain if all vulnerabilities have been addressed. This incident serves as a critical reminder for companies utilizing consumer-facing chatbots to prioritize security measures from the outset.
Implications for Chatbot Security
This situation underscores the importance of robust vulnerability management processes. Organizations must ensure that their disclosure programs are effective and that all reports are acknowledged promptly to avoid misunderstandings that could lead to reputational damage.
Furthermore, the design flaws highlighted in Eurostar’s chatbot reveal a broader trend in AI systems where security is often an afterthought. Companies should implement comprehensive security checks that account for all user inputs and interactions.
As chatbots become increasingly common in customer service, the risks associated with their vulnerabilities will likely grow. Users and organizations alike should remain vigilant about potential security threats and advocate for better security practices in chatbot development.
Key Takeaways
- Review your organization’s chatbot security protocols to ensure comprehensive vulnerability management is in place.
- Encourage prompt acknowledgment of vulnerability reports to prevent misunderstandings with security researchers.
- Implement security checks that evaluate all user inputs, not just the latest messages, to mitigate risks of prompt injection.
- Stay informed about the latest security trends related to AI and chatbots to better protect your systems.
- Conduct regular security assessments of consumer-facing applications to identify and address vulnerabilities proactively.
Key Terms & Concepts
- Prompt Injection: In this article, prompt injection refers to a technique where earlier messages in a chatbot’s chat history are manipulated to extract sensitive information.
- HTML Injection: HTML injection is a vulnerability that allows attackers to insert malicious HTML code into a web application, potentially leading to phishing attacks.
- Stored XSS: Stored XSS occurs when an attacker injects malicious code into a web application, causing it to be delivered to other users as trusted content.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2025/12/24/pentesters_reported_eurostar_chatbot_flaws/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
