🤖💉🔓💥 Web LLM Attacks: Turning a Chatbot’s “Helpfulness” Into Account Takeover

TL;DR: Every company is bolting an LLM onto its product — support bots, "summarize this page" buttons, AI agents that can read your inbox and change your settings. To a hunter, that's not a feature, it's a fresh server-side component with access to APIs and user data, reachable through plain English. In this writeup I walk the full chain the way I actually approach it on a target: fingerprint the LLM feature, map what it can touch, abuse excessive agency, land an indirect prompt injection through data the model ingests, and cash it out through improper output handling into account takeover — all on a lab target with placeholder values. The throughline is the one that matters for a bounty: a weird model response is not a finding. A verified, attacker-controlled action is.

🎯 Why the AI layer is the softest part of the attack surface

Here's the mental shift that makes LLM bugs click: attacking an LLM integration is basically SSRF. You're not exploiting the model's "intelligence" — you're abusing a trusted server-side component to reach things you can't reach directly. The LLM has a database connection, API…