Disclosed vulnerability
Prompt injection in Lenovo's 'Lena' chatbot yields stored XSS that steals a support agent's session cookie
AIR-2025-0104 AIR record · 2025-08-lenovo-lena-stored-xss
From the supporting source
The response was saved in the user's chat history, creating a stored cross-site scripting (XSS) payload. When the researchers requested transfer to a human support agent, the agent's normal workflow of opening the chat transcript caused the poisoned content to render, exfiltrating session cookie data to an attacker-controlled server.raw.githubusercontent.com
The record
Disclosed
2025-08-18
Vendor
Lenovo
Product
Lenovo AI chatbot 'Lena'
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted (contested) — the rendered chatbot output executed and stole the support agent's cookie
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Direct prompt injection user input
Impact type
Session hijack, Data exfiltration
Confidence
Medium
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Lenovo customer-support platform accounts and the customer conversations they can see
Capability abused
Defense & remediation
Recorded defense
output sanitisation (absent)
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Lenovo reported corrective actions
Taxonomy & references
Curator notes
Cybernews research team. The quote is from MITRE ATLAS's published data file rather than the Cybernews article. Borderline for scope: the chatbot emits text, but the downstream effect (session theft against a human operator) is concrete.
Supporting sources
Cite as
Enkrypt AI. "Prompt injection in Lenovo's 'Lena' chatbot yields stored XSS that steals a support agent's session cookie". AIR, AIR-2025-0104. https://agentincident.vercel.app/i/AIR-2025-0104/ (accessed 2026-10-19).