Lenovo's website chatbot could be hijacked by prompt injection to run malicious scripts
Researchers showed that Lenovo's customer-service chatbot, Lena, built on a large language model, could be manipulated by a crafted prompt into returning HTML that executed a cross-site scripting payload, potentially stealing session data from users and support agents.
A crafted message made the support chatbot return HTML that ran a malicious script in the browser.
Key facts
- What
- Researchers showed that Lenovo's customer-service chatbot, Lena, built on a large language model, could be manipulated by a crafted prompt into returning HTML that executed a cross-site scripting payload, potentially stealing session data from users and support agents.
- Incident date
- Aug 18, 2025
- Who
- Lenovo
- Failure mode
- Prompt Injection
- AI surface
- Chatbot
- Severity
- Medium
What happened
In August 2025 Cybernews researchers demonstrated that Lenovo's Lena chatbot would follow injected instructions to output HTML containing a malicious script, enabling cross-site scripting that could exfiltrate session cookies and reach support-agent systems. Lenovo addressed the issue after disclosure.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
Untrusted content (an email, a document, a retrieved page, a tool result) was read as if it were a trusted instruction. The model has no built-in separation between the operator's instructions and the data it ingests, so attacker text in the data channel became commands the model followed.
What it cost
Disclosed XSS-via-prompt-injection vulnerability
Sources
- PressLenovo chatbot Lena vulnerable to XSS via prompt injection (Cybernews)cybernews.com
Cite this entry
https://failureindex.ai/failures/lenovo-website-chatbot-hijacked-promptAI Failure Index. "Lenovo's website chatbot could be hijacked by prompt injection to run malicious scripts" (FI-0068). Realm Labs. https://failureindex.ai/failures/lenovo-website-chatbot-hijacked-prompt (indexed Jun 3, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0068. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.