Disclosed vulnerability
DeepSeek AI: prompt injection to XSS to full account takeover
AIR-2024-0046 AIR record · 2024-11-deepseek-prompt-injection-account-takeover
From the supporting source
This post demonstrated how it is possible for a prompt injection to entirely take over a user's account if an application is vulnerable to XSS, which the LLM can exploit.embracethered.com
The record
Disclosed
2024-11-29
Vendor
DeepSeek
Product
DeepSeek chat (DeepSeek-R1-Lite)
Risk domain
Access control and permissions › Privilege escalation
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the rendered model output executed as XSS and exfiltrated the token
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Account takeover, Session hijack
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
DeepSeek chat users
Capability abused
Defense & remediation
Recorded defense
none - unsanitized model output rendered in the app
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed one day after disclosure via the site's Contact Us feature
Taxonomy & references
Curator notes
Johann Rehberger. The userToken was read out of localStorage and exfiltrated.
Supporting sources
Cite as
Enkrypt AI. "DeepSeek AI: prompt injection to XSS to full account takeover". AIR, AIR-2024-0046. https://agentincident.vercel.app/i/AIR-2024-0046/ (accessed 2026-10-19).