GCD AI RADAR
incidents/AIR-2026-0351

Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot

Attack on AI1 Research / proof of conceptPrompt injectionAgent hijackData leak

Researchers demonstrated that Lenovo's customer support chatbot was vulnerable to a prompt injection that stored malicious HTML in chat history. When transferred to a human agent, the payload could exfiltrate session cookies.

Details

type
Attack on AI
An AI model, agent or AI-powered product was the thing exploited, abused or leaked.
categories
  • Prompt injectionprimary
    Untrusted content (web pages, documents, emails, tool output) steers a model into ignoring its instructions.
  • Agent hijack
    An AI agent is tricked into unauthorized actions: tool misuse, data exfiltration through the agent, or acting against its principal.
  • Data leak
    Training data, chat logs, system prompts, model weights or other AI-system data exposed.
owasp llm top 10
mitre atlas
Both rows are derived from the type and categories (OWASP 2025 edition, ATLAS release 2026.09), not classified per record. How
severity
1 · Research / proof of concept
Demonstrated by researchers; no known real-world exploitation.
targets
Enterprise deployment
products
Lenovo AI Chatbot Lena
incident date
18 Aug 2025
first reported
29 Jun 2026
origin
MITRE ATLAS
Derived from MITRE ATLAS (Apache 2.0, © MITRE).
classifier confidence
0.95 · published at or above 0.80; see the methodology
tags
xss · chatbot · prompt-injection
record
created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z · json

Sources · 2

  1. 2026-06-29
    Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
    MITRE ATLAS · atlas.mitre.org/studies/AML.CS0060
  2. 2026-06-29
    Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies
    cybernews.com · cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities

Titles and links belong to their publishers. The summary above is written by GCD AI RADAR in its own words; data is CC BY-SA 4.0.

Related incidents