Hacking AI customer service agents

Researchers have identified critical security vulnerabilities in AI customer service agents that can be exploited to bypass authentication, exfiltrate sensitive data like one-time passwords, and trick agents into sending phishing emails or performing unauthorized actions. These vulnerabilities—including email spoofing, multi-factor authentication bypass techniques, and knowledge base exploitation—have already resulted in over $50,000 in bug bounties discovered in recent security research. The findings highlight that having humans in the loop is insufficient to mitigate risks posed by increasingly capable AI agents deployed for customer support automation.