Case lenovo-lena-chatbot-xssPrompt injectionChina
Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies
Cybernews used a 400-character prompt to make Lenovo's Lena chatbot emit HTML with a broken image tag that sent cookies to an attacker server, exposing support agents' sessions. Lenovo acknowledged and fixed it.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 18, 2025
- Location
- China
- Target
- Lenovo Lena customer support chatbot (GPT-4 based)
- Severity
- Medium
- Triggered by
- Cybernews research team
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Cybernews used a 400-character prompt to make Lenovo's Lena chatbot emit HTML with a broken image tag that sent cookies to an attacker server, exposing support agents' sessions. Lenovo acknowledged and fixed it.
Impact: Session hijack of live and historical support chats was possible; no evidence of real-world exploitation
Who triggered it
Actor: Cybernews research team
Attribution: Responsible disclosure on 22 July 2025; Lenovo confirmed on 6 August
Motive: Security research
How it happened
Attack vector: Direct prompt injection requesting HTML output; unsanitised chatbot response rendered in the support interface
Root cause: No input validation or output sanitisation between the LLM and the web front end
Timeline
- Cybernews discloses the issue to Lenovo
- Lenovo confirms the vulnerability
- Lenovo patches and Cybernews publishes
Response
Lenovo said it protected its systems after the report
Current status: Patched
Sources (open in a new tab)
- Cybernews cybernews.com
- CSO Online csoonline.com
- BetaNews betanews.com
Cite this case
Lenovo's Lena support chatbot coaxed into XSS payload that steals agent session cookies. AI Threat Watch, case lenovo-lena-chatbot-xss, Aug 18, 2025. https://aithreat.io/cases/lenovo-lena-chatbot-xss/
Permanent link: https://aithreat.io/cases/lenovo-lena-chatbot-xss/