A newly disclosed report shows how security flaws in an unnamed major US retailer’s AI shopping assistant could be chained from a public mobile app to remote code execution on backend infrastructure.
The attack reportedly bypassed multiple protections designed to keep the assistant confined to shopping-related tasks. Rein Security co-founder and CTO Netanel Rubin and researcher Dan Avraham presented the research, titled “Bye Bye AI,” at Black Hat.
Their work shows how an AI assistant can serve as a path into enterprise systems when input validation, runtime controls, and application-layer security are applied inconsistently.
AI Shopping Assistant Flaws
The pair began by fingerprinting five retail assistants: Kroger, Instacart, Amazon Alexa, Walmart Sparky, and Albertsons.
Two questions whether the services sold avocados and the unrelated Spanish greeting “¿Cómo estás?” were enough to reveal differences between basic keyword search, retrieval-augmented systems, and assistants protected by intent-classification gateways.
The unnamed target was a mobile-only shopping assistant built on Google Vertex AI Search.
PWN found four major defensive layers: SSL certificate pinning, an intent classifier that blocked non-shopping prompts, a scoped system prompt, and structured JSON output restrictions.
SSL pinning initially prevented the researchers from intercepting and modifying the application’s encrypted traffic through Burp Suite.
They used Frida instrumentation in an Android emulator to hook the certificate-validation function and force the app to accept the interception proxy’s certificate.
Once they could inspect requests, the researchers discovered hidden fields unavailable through the normal chat interface. They also found that the application applied security checks inconsistently.
The primary chat-input field passed through the intent-classification gateway, but a separate search-query field was forwarded to the backend with significantly weaker filtering.
As a result, prompts rejected by the chat interface could allegedly be sent via the search field under the guise of product queries.
The researchers used this path to bypass the classifier and extract the assistant’s hidden system prompt through indirect transformations, including acrostic-style prompts and word-order manipulations.
The leaked instructions indicated that the assistant could generate and execute Python code. Rubin and Avraham then tested whether that capability was real rather than simulated.
A prompt containing division-by-zero code triggered a Python ZeroDivisionError, suggesting an interpreter had executed the supplied input.
They further validated execution using time-based tests. A normal request reportedly took roughly 5.5 seconds, while prompts instructing the environment to sleep for 10 and 20 seconds took approximately 11.4 and 26.8 seconds, respectively.
PWN said they could access environment variables within the container after the container was executed. They also identified unrestricted Google Maps API keys exposed in app traffic, potentially allowing unauthorized use and unexpected charges.
Rein disclosed the findings to the retailer in March 2026. According to the PWN, the company classified the code-execution capability as an intended feature.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
