Imagine the following: You visit a webpage with a lot of text you don’t want to read and ask your AI assistant for a summary. A few moments later, the AI assistant has extracted one of your emails and sent it to an attacker without you ever knowing.
In October 2025, we found exactly this vulnerability in Firefox’s AI chatbot integration1.
Firefox offers a summarization, explaination and proofread AI feature. When a user makes use of one of these features, Firefox pastes a prompt into the sidebar AI chat including the page title, the selected text (or, if the whole page is summarized, a selection is being made by Firefox) and an instruction on how to process the provided text. The sidebar AI chat is essentially an IFrame of a third-party chatbot (Claude, Copilot, …).
With the rise of AI assistance features in an increasing number of products, we
have begun to focus some of our research efforts on refining our internal
detection and testing guidelines for LLMs by taking a brief look at the new AI
integrations we discover.
Alongside the rise of applications with LLM integrations, an increasing number
of customers come to ERNW to specifically assess AI applications. Our colleagues
Florian Grunow and
Hannes Mohr analyzed the novel attack
vectors that emerged and presented the results at
TROOPERS24 already.
During a red-teaming-style customer project, we managed to get access to an
Rundeck API token. Rundeck is a job scheduler and
runbook automation platform designed to automate routine IT tasks across
multiple systems. At first, we were excited about this API token because if we
could create new Rundeck jobs, we could execute arbitrary code on the Rundeck
nodes and move laterally from there. However, it turned out that with this token
we only had permissions to run existing jobs.
During a customer project, we identified a logic flaw in Jitsi Meet, an open-source video conferencing and messaging platform for secure video conferencing, voice calls, and messaging. The vulnerability affects password protected Jitsi meetings that make use of a lobby. This logic flaw leads to the disclosure of the meeting password when a user is invited to the call after waiting in the lobby.
Jitsi offers two security options to meeting moderators. Firstly, the meeting can be assigned a password that must be entered when joining. Secondly, a lobby mode can be activated, which first adds joining users to a lobby, from where they can then be added to the meeting by a user with moderation permissions.