August 6, 2026
Exploiting AI Agents to Perform Destructive Actions — PortSwigger Lab Write-up
A hands-on walkthrough of exploiting an AI-powered scanner by manipulating user input and uncovering critical vulnerabilities.
By Deep Savaliya
3 min read
In this lab, we are introduced to an AI-powered scanner designed to analyze and investigate user-generated content across a web application. What makes this scenario interesting is that the scanner operates with elevated privileges — it has been provided with the login credentials of another user, Carlos, allowing it to access authenticated areas of the site.
Delete the user Carlos by leveraging the AI scanner.
Understanding the attack surface
The application provides a "Scan site" feature powered by an AI agent. When triggered, it scans blog content and analyzes it for potential vulnerabilities.
Scanner also check for the vulnerability by injecting payload in the comment section
Once the scan is complete, the application provides a "View scan result" option. By clicking this button, you can review the findings generated by the AI scanner, including any identified issues or observations from the analyzed blog content.
After running the AI scanner and reviewing the results, it identified multiple vulnerabilities within the application. The findings highlight a Stored Cross-Site Scripting (XSS) issue in the blog comment functionality, where malicious scripts can be stored and executed when other users view the post. Additionally, an Insecure Direct Object Reference (IDOR) vulnerability was discovered, allowing direct access to user account data through endpoints like /my-account?id=carlos, indicating weak access control.
The results also reveal the sequence of actions performed by the AI agent, including navigating blog posts, accessing account pages, and interacting with various endpoints. This provides valuable insight into how the agent operates with elevated privileges and the extent of its reach within the application.
Next, we post a crafted prompt in the comment section of another blog or product page. Since the AI scanner processes this content, it allows us to influence the agent's behavior through user input.
Submit the comment and back to the blog page
After adding the crafted input, we trigger the process again by clicking the "Rescan" button. This initiates a fresh scan, allowing the AI agent to reprocess the updated content, including our injected comment. Once the scan completes, the results reflect how the agent interprets and responds to the new input.
Once the rescan is completed, the AI agent processes the injected input and due to its elevated privileges and lack of proper safeguards, performs an unintended action. As a result, it accesses the /my-account/delete endpoint and deletes the user Carlos.
By clicking on "View scan result", we can analyze what actions the AI agent actually performed in the backend. The results reveal the sequence of requests and clearly show how the agent interpreted the injected input.
From this, we can observe that the malicious prompt placed in the comment section was processed by the scanner, which then triggered sensitive actions such as accessing account endpoints and ultimately calling the deletion functionality. This step is important because it provides visibility into how user-controlled input can influence backend operations through the AI agent.
Conclusion
This lab highlights the security risks associated with AI-powered agents that operate with elevated privileges and process user-generated content. By injecting crafted input into a seemingly harmless comment section, we were able to influence the behavior of the AI scanner and trigger unintended actions.
The key takeaway is that AI agents should never blindly trust or act on user input, especially when they have access to sensitive functionality. Proper safeguards such as strict input validation, permission boundaries, and human oversight are essential to prevent misuse.
As AI continues to be integrated into applications, understanding and mitigating these risks becomes critical to building secure and reliable systems.