AI Shopping Assistant Vulnerabilities Enable Remote Code Execution on Retailer’s Servers

Security researchers have demonstrated how flaws in the AI shopping assistant of a major unnamed U.S. retailer could be exploited to enable remote code execution (RCE) on the company’s backend infrastructure through its public-facing mobile application.

Netanel Rubin, co-founder and CTO of Rein Security, along with researcher Dan Avraham, presented their findings during a Black Hat talk titled “Bye Bye AI.” Rubin is scheduled to discuss the research in a live Ask Me Anything (AMA) session in the PWN community on Monday, August 31, at 12 PM ET.

AI Shopping Assistant Vulnerabilities

According to the researchers, the attack revealed how vulnerabilities in mobile application controls, AI guardrails, and backend agent capabilities can be combined to create a pathway for significant compromises.

Before targeting the unnamed retailer, Rubin and Avraham evaluated five AI retail assistants from Kroger, Instacart, Amazon Alexa, Walmart Sparky, and Albertsons.

The researchers posed seemingly simple questions to determine whether a search engine, retrieval-augmented generation, or a separate intent-classification layer backed each assistant.

For instance, a shopping-related query asking whether the retailer sold avocados helped assess the bot’s product-search behavior. They also used an unrelated Spanish-language greeting, “¿Cómo estás?”, to test how each assistant handled non-shopping prompts.

The varying responses indicated architectural differences among the assistants. Some behaved like keyword search interfaces, while others either provided conversational responses, declined the request, or blocked it before it reached the underlying model.

This pre-model rejection behavior was particularly significant. The retailer’s assistant employed an intent-classification gateway designed to reject prompts unrelated to shopping.

The retailer’s assistant was available solely through its mobile application and utilized Google Vertex AI Search. As a result, the researchers had to analyze traffic from the Android application rather than a browser-based service.

They routed the app through Burp Suite but encountered SSL certificate pinning, a security measure intended to prevent the interception of encrypted mobile traffic. The team then used Frida to intercept the certificate-validation function in the running application, forcing it to accept the proxy certificate.

Once the traffic was decrypted, the application’s requests revealed hidden input fields that were not exposed through the user-facing chat interface. The researchers discovered that the visible chat field was filtered through the shopping-intent classifier.

In contrast, a separate search-query field was sent to the backend with considerably less filtering. Prompts that were rejected in the chat interface could be submitted through the search field as apparent product searches.

“A single inconsistently filtered input defeated the whole gateway,” the researchers stated.

By utilizing the less-protected search field, Rubin and Avraham successfully bypassed restrictions designed to prevent the disclosure of system prompts.

Instead of directly requesting the prompt, they posed shopping-themed requests, such as generating acrostic poems and reordering text. The leaked instructions indicated that the AI assistant could write and execute Python code.

To verify whether this capability was legitimate rather than a mere imitation, the researchers provided code that caused a division-by-zero exception.

The assistant then returned a Python ZeroDivisionError, confirming execution in a live interpreter. They further tested code execution with timed delays; a baseline response took about 5.5 seconds, while commands that requested 10-second and 20-second delays took approximately 11.4 seconds and 26.8 seconds, respectively.

These time discrepancies served as evidence that code was indeed being executed on the backend infrastructure.

The researchers also noted that they could access environment variables from the backend container after achieving RCE.

The team identified live Google Maps API keys within the decrypted application requests. These keys reportedly lacked restrictions on authorized applications, referrers, or source locations, which could potentially allow for abuse that would incur charges for the retailer.

Rein Security disclosed these findings to the retailer in March 2026. The company reportedly classified the RCE behavior as an intended feature and categorized the report as informative. When the research was published after the 90-day disclosure period, the issues were said to remain unresolved.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC