AI-powered customer service agents can be manipulated to bypass authentication controls, expose customer information, send phishing emails, and leak one-time passcodes.
Documented by Intigriti security researchers Ayoub and Inti De Ceukelaire, the research illustrates how customer-experience agents create security risks when they can read support inboxes, access knowledge bases, invoke backend tools, or perform account actions.
The researchers said the techniques produced more than $50,000 in bug bounties over several weekends, without relying on conventional vulnerability scanners.
AI Customer Service Agents Can Be Hacked
A major issue is the way some AI support systems process email identity. In one scenario, a chatbot accepted email-based conversations and used the visible From header to identify a customer.
An attacker could spoof that header, issue a malicious instruction, and cause the bot to send a phishing message appearing to originate from a trusted support address.
Other cases involved discrepancies between email authentication and the information an AI agent parsed. Email servers may validate one sender identity through SPF or DKIM, while an agent uses another header to determine which customer account to access.
If reply-routing controls are also weak, the agent could retrieve account data associated with a victim and send the response to an attacker-controlled address.
The researchers also documented MFA weaknesses. AI agents that apply rate limits using raw email strings may be susceptible to email-normalization quirks, allowing attackers to generate additional OTP guesses while targeting the same underlying mailbox.
Support workflows can introduce another weakness when the same identity-verification request is handled separately through web chat, email, and interactive voice response systems.
IVR-based support systems may be particularly exposed if they trust caller ID, rely on guessable knowledge-based questions, or reuse OTPs across calls.
Attackers can exploit inconsistent verification controls between channels to reset an authentication flow or increase the number of attempts available for a code.
Another high-impact scenario involves third-party OTP theft. An attacker may first poison an AI agent’s email context with an instruction disguised as a message from a trusted sender.
They can then trigger a legitimate password-reset email from an external service. If the agent reads the new message and follows the planted instruction, it could transmit the OTP to attacker infrastructure, enabling takeover of the organization’s third-party account.
The research also warns that human review does not automatically eliminate the risk. Attackers can create “asymmetric” messages in which a human sees harmless HTML content while the AI processes a different plain-text payload.
They may also forge quoted conversation history, poison retrieval-augmented generation knowledge bases through public comments, or manipulate tool responses the model consumes.
Organizations deploying AI service agents should treat them as privileged automation systems.
They should normalize identities before authorization decisions, isolate untrusted email content from instructions, enforce consistent MFA limits across every channel, restrict tool permissions, validate knowledge-base sources, and require deterministic policy checks before sensitive actions such as profile changes, refunds, data exports, or payment requests.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
