On March 12 2026, Rein Security’s Agent Breakers research team identified a chain of security vulnerabilities in a top retailer’s AI shopping assistant.
The agent is accessible through multiple platforms. It is designed to help users discover products, compare items, answer shopping questions, and navigate the retailer’s catalog through natural language interactions. These vulnerabilities revealed severe, structural security gaps present in the enterprise-scale AI agent deployment used by millions of daily shoppers.
We targeted the assistant as part of an independent initiative to identify security gaps in large-scale enterprise agent deployments. The core research objective was to show that current defensive strategies, specifically LLM gateways that simply monitor incoming prompts and outgoing responses while treating the AI as a “black box”, are fundamentally inadequate for securing complex, decision-making AI architectures.
What began as an observation about its comparison feature––specifically its ability to retrieve content from arbitrary external websites- evolved into a five-stage exploit chain. The exploit chain was executed entirely through the application’s public mobile interface without requiring any privileged access.
Discovery & Investigation of System Infrastructure
The agent’s interface presents as a standard chat UI with follow-up suggestion buttons and a “Sources” drawer that shows which external websites the agent consulted when forming a response. The system appears to include an intent-classification layer that attempts to constrain responses to shopping-relevant topics, but as this research demonstrates, that classification was not applied uniformly across all input parameters.
Why the LLM gateway failed:
- LLM gateways work by inspecting prompts before they reach the model and evaluating responses before they are returned to users – treating the agent as a black box.
- The specific gateway deployed used an intent classification model to determine whether a request fell within the intended shopping context, suppressing or blocking out-of-scope content.
- The gateway cannot observe internal tool invocations, API calls, the retrieval of content, or the chain of actions the agent takes after a prompt is accepted.
- LLM-based gateway layers are susceptible to the same prompt manipulation techniques they are designed to block.
- Result: the gateway can observe the traffic entering and leaving the system, but it is blind to the attack once it crosses the intent classification threshold.
Based on analysis of the decrypted HTTPS traffic, the backend is routed through a major cloud provider’s enterprise search infrastructure. Requests from the mobile client are forwarded to the retailer’s backend services, which in turn interact with the cloud provider’s AI search engine service for retrieval-augmented generation.
During our research, we used the following tools:
- Android Emulator (AVD): Isolated mobile environment for testing the retailer app
- Frida 17.8.2: Dynamic instrumentation framework for SSL pinning bypass
- Burp Suite Pro: Interception proxy for HTTPS traffic analysis
- Custom CA Certificate: Installed in emulator trust store to decrypt TLS traffic
- cURL: API key validation against Google Maps Geocoding API
All testing was conducted in a controlled research environment using a dedicated Android emulator. No production systems were modified, no real user data was accessed beyond what was generated within our own test session, and no denial-of-service conditions were intentionally triggered.
Key Findings & Exploitation Through a Five-Stage Chain
The retailer deployed strong filters for its main chat interface, but the same effective intent classification filtration wasn’t applied to the app’s standard search query field, which became the primary injection vector. We were able to bypass the intent classification layer entirely. In an attack scenario, this could be used as an unprotected “side door” to bypass the security entirely and send direct, malicious instructions that the AI would ingest and follow.
The Multi-Stage Exploit Chain:
- Stage 1 – Comparison feature exploitation via indirect prompt injection: By interacting with the product comparison functionality, we were able to cause the assistant to fetch data from attacker-controlled external sources. Rather than remaining limited to a closed, retailer-controlled retrieval scope, the agent delegated retrieval to a fetcher-style process that could ingest untrusted external content – creating an indirect prompt injection risk.
- Stage 2 – Differential parameter handling and gateway bypass: Through HTTPS traffic analysis via Frida-based SSL unpinning, we observed the search query field was forwarded more directly to the backend and was not subjected to the same effective filtration path as chat messages.
- Stage 3 – Internal context and tool structure disclosure: By exploiting the search query injection path, we were able to elicit the assistant’s internal prompt context, including system tool names, invocation syntax, and policy hints. Once the tool execution structure was exposed, the gap between prompt manipulation and tool abuse narrowed significantly.
- Stage 4 – Remote code execution in the agent environment: Using the disclosed internal context, we constructed a second-stage payload that caused the assistant to execute attacker-controlled tool code within its backend execution environment. The returned output contained runtime values consistent with actual execution: directory listings, environment variables and filesystem information.
- Stage 5 – Google Maps API key exposure: During HTTPS traffic analysis, we identified Google Maps API keys exposed in the mobile app’s decrypted traffic. These client-usable credentials were accessible to anyone capable of intercepting app traffic.
Our research found that it required no privileged access and no infrastructure compromise. It occurred entirely through the same interface used by everyday shoppers, and appeared as ordinary user activity to the underlying systems.
Post-Exploitation & Remediation Status
This hack was performed as a security research initiative. We identified the vulnerabilities and reported it to the retailer through responsible disclosure on March 13, 2026.
As of July 16th, 2026, the date of this report’s publication and past the 90-day disclosure window, The retailer has not remediated the vulnerabilities. Due to legal reasons, we are unable to disclose the name of the retailer.
Why It Matters
Enterprises across every industry are racing to deploy AI agents, but the security infrastructure designed to protect them has not kept up.
Our research shows the consequences of this agentic AI security gap. This retailer is one of the most sophisticated technology enterprises in the world. The company had a dedicated security layer specifically built for its AI system, however, the vulnerabilities we uncovered existed beyond the gateway. They lived inside execution, in the tool calls, the retrieval pipeline, the backend environment–where the gateway had no visibility. If the security layer cannot see what an agent is doing during execution, neither can the security team.
This visibility gap is becoming increasingly consequential because enterprise agents represent a fundamentally different security challenge where the stakes are much higher. Three years ago, an agent was a model generating text. A year later, it could reason and write your code. Today it runs workflows, makes customer-facing decisions at scale, generates revenue, and has access to sensitive systems and data. The security that has been built during this first era monitors inputs and outputs, filters prompts, and classifies intent at the gateway layer. It doesn’t address what an agent actually does during execution.
As agents gain more autonomy and have direct impact on the business, any organization relying on a gateway as the primary control layer for today’s era of AI agents is highly vulnerable to exploitation. Organizations building and deploying enterprise agents must move beyond traffic-layer inspection and invest in execution-context visibility to effectively secure them.
This is where Rein Security comes in. We provide end-to-end visibility into every agent action and its business impact, unifying posture management, security, compliance and governance in a single platform. Our platform applies behavior-based controls to prevent harmful agent actions before they occur, and preserves data privacy by keeping customer data entirely within the organization’s environment.
To learn more about the research, join our Black Hat talk on August 5th 2026
