Researchers at cybersecurity firm Rein Security demonstrated at the Black Hat conference in Las Vegas that they could trick an AI shopping assistant used by one of the three largest US retailers into running malicious code, exposing internal system details. The attack began with the assistant’s product comparison feature, which can pull information from external websites, and ended with the researchers obtaining directory listings and environment variables that ordinary shoppers should never see. The retailer was not named, and Rein cited legal concerns for withholding its identity, meaning the findings cannot be independently verified.
The technique used was an indirect prompt injection, where the researchers planted instructions in content they controlled and the AI retrieved it as part of a legitimate task. Instead of summarizing the material, the assistant treated some of it as new directives to follow. The retailer had a security layer designed to keep the assistant focused on shopping, but the researchers found that the app’s regular search field lacked the same protections as the main chat interface, allowing them to bypass the safeguards.
Through that less-protected input, the researchers persuaded the assistant to reveal internal tool names and the syntax for calling them. They then crafted further instructions that caused the assistant to execute code within its own computing environment, returning file lists and confirming their commands had run. This crossing of a security boundary is significant because it shows the AI could be manipulated into actions beyond its intended role, though Rein’s public account does not establish whether the environment could access customer, payment, or inventory data.
The researchers reported the vulnerabilities on March 13, and as of July 16, more than 90 days later, Rein said they had not been fixed. No newer update on the status of the problems was provided. The researchers stated they did not access real customer information, alter orders, or disrupt the retailer’s systems, and their work was performed in a controlled environment using their own session.
The demonstration highlights a broader risk as retailers expand AI assistants to handle tasks like building shopping lists, checking inventory, and managing orders. Each new capability creates another avenue for attack if the AI can be tricked into following malicious instructions. In this case, Rein noted that the retailer’s security system monitored the conversation between shoppers and the AI but could not see everything in between, including retrieved data and tool usage, creating a blind spot where the system saw the chat but not all the AI’s actions.
