Pen testers accused of 'blackmail' after reporting Eurostar chatbot flaws Researchers at Pen Test Partners found four flaws in Eurostar's public AI chatbot that, among other security issues, could allow an attacker to inject malicious HTML content or trick the bot into leaking system prompts. Their thank you from the company: being accused of "blackmail." The researchers reported the weaknesses to …
"And then, per a LinkedIn screenshot with Eurostar exec's name and photo blacked out, the security boss replied: "Some might consider this to be blackmail.””
To which the obvious answer is “possibly yes, although I do think most will consider this to be fucking incompetence on your part”.
So we've turned the clock back to the early days of companies being online, when every report of a flaw in the public facing system was met with accusations of "hacking", including claims the "hacker" (aka pen tester nowadays) was trying to extort or blackmail the company.
And probably for the same reason: the company[1] thinks its system *must* be perfect, so the only way it can go wrong is by deliberate attacks.
[1] The senior management, that is; everyone else knows it is proped up matchsticks.
As someone who operates a VDP, I have mixed feelings. While we value and reward all reports, some reporters push for very short disclosure timelines in order to be the first to publish a security flaw. Responsibility for coordinated disclosure lies on both sides, yet this report feels rather one-sided. Articles like this also create negative PR for the involved penetration testers. Rest assured many will label "Pen Test Partners" as drama queens.
The article clearly states that the vulnerability was disclosed on June 11 (no response), followed up on June 18 (no response), followed up via another channel (LinkedIn) on July 7 (was told to use the vulnerability reporting program which is what he used back on June 11, and was accused of blackmail), and July 31 (found there was no record of a bug report). So that's a month and a half where Eurostar didn't even have a record of a report. While I'd like to see a response from Eurostar, what was provided to El Reg pretty clearly shows Eurostar trying to shoot the messenger. This is NOT a "very short disclosure timeline".
PTP are the good guys and they give out good socks at the trade events. Ken is a good guy, I've met him several times.
If someone finds a problem in your product, say thank you and fix it. Its a bit like someone telling you that your tail light is out. Shouting at them isn't going to fix it.
This all seems a bit casual by Eurostar.
Given the nature of Eurostars business, they’d fall under the Data Protection Act (or whatever it’s called these days). I should think that the company Information Officer would prefer not to have to explain to the Information Commissioner why a disclosed flaw met with this level of indifference, should they in fact get rolled over and a data breach occurred.
I’d be interested to learn of my fellow commentators‘ views on the idea of making such disclosures to the company information officer as well as (or instead of) to any vulnerability disclosure form. I suspect that the latter often gets dumped into the IT department somewhere (where it may fester, as happened here), where as the IO is likely more interested because they’re the one who owns the consequences of inaction.
Obviously it’s not the pen tester’s job to sort out internal comms problems in dysfunctional companies! But it’s interesting to consider what the best disclosure route actually is.
I liked the way the pen tester handled it in this article - report through the official channels, check back, and when it looked like nothing happened, contact the relevant person directly. While this *shouldn't* ever be necessary, it unfortunately sometimes is. (Note this works for many, many things, not just vulnerability disclosures.)
> why was their system pulling the chat history from the browser
Okay, I'll bite! A combination of:
1. CxOs supping the kewl-new-thing juice, followed by; 2. PHB oversight of; 3. AGILE dev teams composed of; 4. vibe coders using; 5. untested/unknown third party APIs/libraries/tools with; 6. insufficient numbers of humans in the customer services department to catch the issues when the shit hits the fan.
But you already summarised that:
> This was pure incompetence.
I asked a couple of recent CS graduates about this. Apparently (this is UK universities but it may be similar elsewhere) you will not be taught about never trusting the client side by whoever delivers the course in web programming, but it will probably come up if you select a computer security module and if you have the presence of mind to apply knowledge from one module to the context of the other. (There is, of course, nothing to stop you graduating if you don't make that link.)
Also, both of them actually knew this principle anyway because it is pretty fundamental to Roblox game design. I shouldn't be too smug here though because I learned this stuff by reading El Reg for several decades
Anyone *not* competent enough to generalise that principle from their computer security course to web design shouldn't be working in computer security *or* web design.
That said, the basic principle- if not the fine details- is something that *everyone* doing a web design course should be made aware of, whether or not they're doing the computer security module.
We all should know by now that there is no such things as guardrails on gAI.
We already know that all of them can be bypassed.
Gödel proved such things would be impossible back in the 1930s. They need to complete and correct, and he proved this was not possible.
( the above is obviously very broad strokes )
Increasingly, I am seeing Social Media posts with missing words in the blitherstream.
The initial prompt in the example here contains such an omission.
I'd be very interested to know why this is such a widespread phenomenon.
As for A.I., what do expect from software developed to predict text inputs on a phone?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
