Lenovo's Lena support chatbot tricked into serving XSS that steals support-agent session cookies
Lenovo (Lena chatbot) · Aug 18, 2025 · Customer service agent
What happened
Cybernews researchers showed that a single ~400-character prompt could make Lena, Lenovo's GPT-4-powered support chatbot, emit attacker-controlled HTML that executed in the support platform — capturing active session cookies, including those of human support agents the conversation was escalated to. Lenovo acknowledged the XSS vulnerability and implemented corrective measures before August 18, 2025.
Causal vector
Unsanitised LLM output rendered as HTML in a privileged support console — the chatbot became an XSS delivery channel
Source
Reported by CSO Online. Verified against the primary report.
Model output flowed straight into a privileged surface with no policy layer between. The firewall pattern is output-side too: agent-produced artifacts that touch privileged systems get validated against a schema or allowlist, and anything else is BLOCKED — sanitisation as policy, not as prompt.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
NeuralTrust: 34.9% of enterprises report confirmed AI agent security incidents
NeuralTrust · Jun 1, 2026
HUMAN Security: AI agent traffic grew 7,851%, 8x faster than human traffic
HUMAN Security · Jan 1, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 67 documented failures, one control.