Pen testers accused of ‘blackmail’ after reporting Eurostar chatbot flaws

According to The Register, researchers at Pen Test Partners found four flaws in Eurostar’s public AI chatbot that could allow an attacker to inject malicious HTML content or trick the bot into leaking system prompts. The researchers reported the weaknesses to Eurostar through its vulnerability disclosure programme, and Eurostar ultimately patched some of the issues. During the responsible disclosure process, the train operator’s head of security allegedly accused the pen-testing team of blackmail.

The story draws on a blog published by the penetration testing and security consulting firm, which details what happened. Readers are directed to The Register for the full account and to the firm’s blog for additional context.