Misuse1 sourceFirst seen
Vincent AI Gets Tricked Into Serving Up a Fake Login Screen
Ourtake
Legal research tool, meet the oldest trick in the phishing book: hide instructions in white text and hope nobody notices.
What happened
Security researchers at PromptArmor showed that a prompt injection hidden in white-on-white text in an uploaded document could make vLex's Vincent AI output HTML that displayed a fake vLex login pop-up to users, which could capture credentials. vLex fixed the issues after responsible disclosure.