Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
Lenovo AI Chatbot Lena
Researchers demonstrated that Lenovo's customer support chatbot was vulnerable to a prompt injection that stored malicious HTML in chat history. When transferred to a human agent, the payload could exfiltrate session cookies.
- first report
- 29 Jun 2026
- last update
- 29 Jun 2026
Timeline · 2
Sources · 2
News and write-ups
- 2026-06-29Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookiescybernews.com · cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities
Research and catalogues
- 2026-06-29Cross-Site Scripting via Prompt Manipulation in Lenovo AI ChatbotMITRE ATLAS · atlas.mitre.org/studies/AML.CS0060
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- lane
- Research
- AI role
- Attack on AI
- categories
- Prompt injectionAgent hijackData leak
- severity
- 1 · Research / proof of concept
- targets
- Enterprise deployment
- owasp llm top 10
- LLM01:2025 Prompt InjectionLLM02:2025 Sensitive Information DisclosureLLM06:2025 Excessive Agency
- dates
- happened 18 Aug 2025 · first reported 29 Jun 2026
- origin
- MITRE ATLASDerived from MITRE ATLAS (Apache 2.0, © MITRE).
- record
- confidence 0.95 · created 2026-10-18 06:55Z · updated 2026-10-18 06:55Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot https://gcdradar.vercel.app/incidents/cross-site-scripting-via-prompt-manipulation-in-lenovo-ai-ch · AIR-2026-0351 · closed 2026-07-13 - Lane: Research - Severity: 1 (Research / proof of concept) - Fix status: Fix status unknown - First reported: 2026-06-29 (happened 2025-08-18) - AI role: Attack on AI - Products: Lenovo AI Chatbot Lena ## Summary Researchers demonstrated that Lenovo's customer support chatbot was vulnerable to a prompt injection that stored malicious HTML in chat history. When transferred to a human agent, the payload could exfiltrate session cookies. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-06-29: Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies (https://cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities) - 2026-06-29: Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot (https://atlas.mitre.org/studies/AML.CS0060) ## Sources - 2026-06-29 MITRE ATLAS: Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot https://atlas.mitre.org/studies/AML.CS0060 - 2026-06-29 cybernews.com: Critical flaw plagues Lenovo AI chatbot: attackers can run malicious code and steal cookies https://cybernews.com/security/lenovo-chatbot-lena-plagued-by-critical-vulnerabilities Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- closedCursor Data Exfiltration via MCP Server Prompt Injection Targeting Cursor
Research · since 24 Jun 2025
AI - closedMicrosoft 365 Copilot EchoLeak Zero-Click Prompt Injection on M365 Copilot
Research · since May 2025 (approx.)
AI - closedLLM Desktop Applications AIKatz Extracts Authentication Tokens from LLM Desktop Apps
Research · since 2025 (approx.)
AI - closedSlack AI Data Exfiltration from Slack AI via Indirect Prompt Injection
Research · since 20 Aug 2024
AI - closedCopilot Studio Data Exfiltration via Prompt Injections in Copilot Studio Agent
Research · since Jun 2025 (approx.)
AI - closedClaude Code GitHub Action Claude Code GitHub Action Secret Exposure via Prompt Injection
Research · since 5 Jun 2026
AI