Disclosed vulnerability
Screen-takeover in vLex Vincent AI: injected document makes the legal-research agent render an attacker-controlled HTML login popup
AIR-2026-0148 AIR record · 2026-07-vlex-vincent-ai-screen-takeover
From the supporting source
A prompt injection concealed in an uploaded document can manipulate Vincent AI into responding to the user with HTML code, resulting in a malicious attacker-controlled login pop-up being displayed to the user.promptarmor.com
The record
Disclosed
2026-07
Vendor
vLex (acquired by Clio)
Product
Vincent AI (vLex legal research platform)
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Confused deputy
System type
Generative model
Who acted
Agent acted — the legal agent rendered the attacker's HTML login popup
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document hidden text
Impact type
Credential theft, Ui spoofing, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Vincent AI users who upload documents from opposing parties or third parties
Capability abused
Defense & remediation
Recorded defense
none - model output rendered without HTML sanitization
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed before publication in line with PromptArmor's recommendations
Taxonomy & references
Curator notes
PROVENANCE CAVEAT: the page states no publication date; 2026-07 in the incident_id is provisional and date_disclosed is left null. PromptArmor. Legal-sector agent; the writeup notes further potential for JavaScript execution, session token theft, forced downloads and cryptomining. | date_disclosed is recorded to the month only; no source establishes the exact day.
Supporting sources
Cite as
Enkrypt AI. "Screen-takeover in vLex Vincent AI: injected document makes the legal-research agent render an attacker-controlled HTML login popup". AIR, AIR-2026-0148. https://agentincident.vercel.app/i/AIR-2026-0148/ (accessed 2026-10-19).