AI Chat Assistants Vulnerable to Transcript Injection via Browser DevTools

A security flaw affecting many production AI chat assistants allows attackers to manipulate conversation history directly from a browser's network tab, requiring no prompt engineering or special tools. The vulnerability stems from a common implementation pattern where the client sends the entire message history to the server on every turn, meaning all messages — including those claiming to be from the assistant — are effectively user-controlled input. By injecting fabricated assistant turns, an attacker can make the AI model believe it has already verified a user's identity or granted elevated permissions, bypassing content filters entirely since no suspicious language is used. The root cause is that AI models treat assistant-role messages as trusted records of what actually occurred, making forged history more convincing than traditional jailbreak prompts. The fix is straightforward: servers should retrieve conversation history from their own database rather than accepting it from the client, accepting only the latest user message per request.