Eurostar AI Chatbot Vulnerabilities and Disclosure Mishandling
Pen Test Partners discovered multiple security vulnerabilities in Eurostar's AI chatbot, including weak validation and HTML injection flaws. Eurostar's mishandling of the responsible disclosure process, including allegedly accusing researchers of blackmail, drew criticism over governance failures.
What happened
Pen Test Partners discovered multiple vulnerabilities in Eurostar's AI-powered customer support chatbot during routine testing in mid-2025. The flaws included weak message validation and HTML injection capabilities that allowed researchers to bypass safety guardrails, extract internal system information, and manipulate earlier messages in chat sessions.
The security firm reported the vulnerabilities through Eurostar's official disclosure process starting in mid-June but received no response. After multiple follow-up attempts via email and LinkedIn, a Eurostar security executive allegedly suggested that continued attempts to draw attention to the issue could be interpreted as blackmail.
Reported impact
Eurostar stated that customer data was never at risk and that the chatbot was not connected to sensitive customer information. However, Pen Test Partners warned that such flaws could become more serious if the system were later expanded to handle bookings, personal information, or account access.
Index analysis
The vulnerabilities stemmed from weaknesses in how the chatbot handled conversation history and message validation. Researchers were able to inject arbitrary HTML into chatbot responses and bypass internal safety guardrails.
Governance controls
Eurostar later acknowledged that the original disclosure email had been overlooked and stated that some reported issues were subsequently addressed. However, the firm did not clarify exactly what was fixed, when it was fixed, or whether all vulnerabilities were fully remediated.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.