AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims
DEF CON 34 research shows AI customer-service agents can be manipulated via prompt injection and email tricks to leak OTPs and act as victims.
Inti De Ceukelaire, presenting at Bug Bounty Village during DEF CON 34, demonstrated attacks against AI-powered customer service bots with access to customer profiles, billing data, support inboxes, and refund tools. Techniques include transcript-based phishing from trusted support addresses, From-header identity confusion, email normalization abuse to bypass OTP rate limits, and knowledge-base poisoning via RAG crawlers. He recommends separating untrusted content from system prompts, session-bound authentication, consistent email normalization, server-side tool validation, and least-privilege permissions for AI agents.