Eurostar Accused Researchers of Blackmail for Reporting AI Chatbot Flaws

**Researchers at Pen Test Partners disclosed multiple security flaws in Eurostar's AI chatbot — a design flaw that only checked the last message allowed guardrail bypass and prompt injection (revealing internal instructions and model details), plus HTML injection and unverified conversation IDs that could enable session replay or content injection; the issues were reported to Eurostar, eventually patched, and the case underscores that traditional web security remains crucial for AI frontends.**