Lenovo's website chatbot could be hijacked by prompt injection to run malicious scripts

Researchers showed that Lenovo's customer-service chatbot, Lena, built on a large language model, could be manipulated by a crafted prompt into returning HTML that executed a cross-site scripting payload, potentially stealing session data from users and support agents.

Lenovo · Incident Aug 18, 2025 · Indexed Jun 3, 2026 · 1 source

A crafted message made the support chatbot return HTML that ran a malicious script in the browser.
What
Researchers showed that Lenovo's customer-service chatbot, Lena, built on a large language model, could be manipulated by a crafted prompt into returning HTML that executed a cross-site scripting payload, potentially stealing session data from users and support agents.
Incident date
Aug 18, 2025
Who
Lenovo
Failure mode
Prompt Injection
AI surface
Chatbot
Severity
Medium

What happened

In August 2025 Cybernews researchers demonstrated that Lenovo's Lena chatbot would follow injected instructions to output HTML containing a malicious script, enabling cross-site scripting that could exfiltrate session cookies and reach support-agent systems. Lenovo addressed the issue after disclosure.

What broke inside the model

Failure path · mode profile · Prompt Injection
  1. 01 · TriggerThe model reads retrieved or user-supplied text.
  2. 02 · Model stepThat text carries hidden instructions.
  3. 03 · Control gapNothing separates untrusted data from trusted commands.
  4. 04 · FailureThe injected instruction overrides the operator's.
  5. 05 · ConsequenceThe system acts on an outsider's intent.

At the injection point, retrieved text overrides the operator's instruction.

Untrusted content (an email, a document, a retrieved page, a tool result) was read as if it were a trusted instruction. The model has no built-in separation between the operator's instructions and the data it ingests, so attacker text in the data channel became commands the model followed.

Public visibilityMedium
Regulatory exposureNone
Customer impactMany customers
Financial impactUnknown
Time to disclosureDays

Disclosed XSS-via-prompt-injection vulnerability

  1. PressLenovo chatbot Lena vulnerable to XSS via prompt injection (Cybernews)cybernews.com
Permalinkhttps://failureindex.ai/failures/lenovo-website-chatbot-hijacked-prompt
CitationAI Failure Index. "Lenovo's website chatbot could be hijacked by prompt injection to run malicious scripts" (FI-0068). Realm Labs. https://failureindex.ai/failures/lenovo-website-chatbot-hijacked-prompt (indexed Jun 3, 2026).
Share cardA branded image of this record for posts and slides.

Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0068. Full dataset at /data.

Note from Realm Labs, the Index steward

How Realm would have caught this

Controls for this failure mode
  • Prism
  • OmniGuard

Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.