This Hacker Made $8,000 Hacking a Major Retailer's AI Chatbot Over DNS (Live Demo!)

[BLUF]
This video demonstrates how to exploit AI chatbots in e-commerce environments by bypassing security guardrails using semantic evasion and out-of-band data exfiltration via DNS lookups, a technique that previously yielded an $8,000 bug bounty 0:00.

Key Takeaways:
• Attackers can bypass direct refusals for sensitive terms like "promo code" by using semantic variations such as "save money" or "personalized offer" to trick the model into revealing information 7:00.
• When direct exfiltration methods (like markdown or HTTP) are blocked by sanitization, attackers can discover available tool calls and abuse benign features, such as domain lookups, to exfiltrate data via DNS requests 9:00.
• Social engineering AI involves framing requests within a legitimate business context, such as pretending to be a developer testing API connectivity, which makes the model more likely to comply with unusual requests 14:30.
• Understanding the specific business logic and ecosystem of a target company helps predict which tools an AI agent might have access to, allowing for more targeted exploitation 20:30.
• The demonstrated lab challenges are available for free on HackingHub, offering easy to hard difficulty levels to practice these AI hacking techniques 1:20.

[Closing statement]
Effective AI exploitation relies less on breaking guardrails directly and more on finding indirect paths through available tools and business logic. By social engineering the AI into performing legitimate-seeming tasks, attackers can leak sensitive data without triggering security alerts.

Sources:

• 0:00 Introduction to the AI hacking lab and objective.
• 7:00 Using semantic evasion to bypass refusals.
• 9:00 Exfiltrating data via DNS lookups.
• 14:30 Framing requests as business integrations.
• 20:30 Leveraging business logic knowledge.
• 1:20 Overview of the free HackingHub lab.