At Bug Bounty Village during DEF CON 34, researchers from Intigriti demonstrated how attackers can exploit AI customer service agents to perform unauthorized actions or leak sensitive data, resulting in over $50,000 in bounties.

One prominent method involves exploiting how agents process emails. By using "email address smuggling"—a technique where an attacker uses a specially crafted email address containing comments allowed by RFC 5322—they can trick an agent's backend into retrieving data from a victim's account. Attackers can also exploit the email protocol itself by sending emails with multiple "From" headers to bypass authentication checks or by using asymmetric messaging, where the AI agent and the human recipient see different contents within the same multipart/alternative email.

Furthermore, the research highlighted vulnerabilities in Retrieval-Augmented Generation (RAG) pipelines. Attackers can poison the data sources, such as community forums or sitemaps, that these systems crawl, leading the agent to treat malicious instructions as factual information. Other demonstrated vectors include bypassing two-factor authentication (2FA) by manipulating email validation or exploiting Interactive Voice Response (IVR) systems, and performing context manipulation through spoofed quoted replies in operator consoles.

Sources: