AI Chatbots
The challenge
Customer-facing AI chatbots are one of the largest attack surfaces for prompt injection and related LLM vulnerabilities. Every chatbot deployed on a website, mobile app, or messaging platform provides adversaries with a direct, interactive channel to probe for weaknesses.
The core challenge is that chatbots must accept arbitrary natural-language input from untrusted users while maintaining strict behavioural boundaries. They must be helpful and conversational without revealing confidential information, generating harmful content, or deviating from their intended purpose.
Unlike internal tools where users can be trusted to some degree, public chatbots face the full spectrum of adversarial behaviour. Attackers range from curious users testing boundaries to sophisticated adversaries systematically probing for data extraction opportunities. A single successful attack on a customer-facing chatbot can result in data breaches, reputational damage, and regulatory penalties.
Chatbots also face unique risks around brand safety. An AI chatbot that can be manipulated into making offensive statements, false promises, or inappropriate recommendations directly damages the deploying organisation's reputation, often with immediate and viral consequences.
What Secuvon tests
Prompt Injection & Jailbreak
Direct injection and jailbreak attempts that try to override the bot's instructions.
98 tests in the corpus
System Prompt Extraction
Attempts to make the bot reveal its own instructions.
80 tests in the corpus
PII & Data Leakage
Probes for personal data the bot should never repeat.
76 tests in the corpus
Multi-Turn Attack Chains
Conversations that build context over several turns before the attack.
86 tests in the corpus
Encoding & Obfuscation
Payloads hidden in encodings and formatting.
80 tests in the corpus
Content Safety
Requests for harmful or inappropriate content.
50 tests in the corpus
An assessment sends its tests to the agent you register, through a hosted provider or your own HTTP endpoint. Choose a versioned profile, from Smoke 25 through the full 4,075-test corpus, within your contract capacity. A profile draws a fixed set of tests from these modules, so a module's whole count runs only with the full corpus. Every answer is graded by the published rule for its test, and the report keeps the transcript as evidence.
Illustrative scenarios
Hypothetical examples of the attack classes above, written for this page. They are not incidents Secuvon investigated or customer cases.
Customer support bot leaks internal pricing
An attacker engages the support chatbot in a conversation about product pricing. Over several turns, they shift from asking about public prices to requesting internal discount structures and margin information. The chatbot, trying to be helpful and operating with access to internal documentation, provides details about wholesale pricing tiers that are strictly confidential.
E-commerce chatbot generates harmful recommendations
An adversary uses a multi-turn role-play attack to bypass content safety guardrails on a retail chatbot. Starting with innocuous product questions, they gradually shift the conversation context until the chatbot provides recommendations that could cause physical harm, such as unsafe product combinations or incorrect dosing for health supplements.
Banking chatbot reveals system architecture
An attacker targets a financial services chatbot with encoded injection payloads embedded in what appears to be an account enquiry. The payload causes the chatbot to reveal details about its backend systems, including API endpoints, database table names, and authentication mechanisms, providing a roadmap for further attacks on the institution's infrastructure.