Is my website chatbot vulnerable? A 15-minute self-test
Five checks for the chatbot on your website or inside your app. Each one ends as detected, unknown or confirmed by owner evidence.
Founder, Newly
Published Last updated
Probably in at least one way, and you can find out in 15 minutes without attacking anything. Check what the chatbot's prompt and files expose, what its tools can do, what its replies are allowed to load, what a stranger can spend through it and what outside text it reads. Mark each result detected, unknown or confirmed by owner evidence.
| Check | Time | OWASP 2026 entry | What you look at |
|---|---|---|---|
| 1. Hidden context | 3 min | LLM08 Hidden Context Exposure | System prompt, knowledge files, where the provider key lives |
| 2. Tools and access | 3 min | LLM03 Excessive Agency | Every action the bot can take and the account it uses |
| 3. Reply rendering | 3 min | LLM10 Improper Output Handling | Markdown, images, link previews, CSP header |
| 4. Cost | 3 min | LLM06 Unbounded Consumption | Spend cap, per-visitor limits, message length |
| 5. What it reads | 3 min | LLM01 Prompt Injection | Forms, emails, files and pages that outsiders can write to |
What does vulnerable mean for a website chatbot?
A chatbot treats text as instructions, whether the text comes from your prompt, a visitor or a document it reads. OWASP's 2026 entry on prompt injection says models do not separate instructions from data, so there is no equivalent of a parameterised database query. MITRE added direct and indirect prompt injection to ATT&CK on October 13, 2026.
So a pass or fail on injection is not on offer. The question to answer is what a successful injection could reach. This page treats your chatbot as vulnerable to the extent that it holds secrets, can act, can leak through its replies or can spend money. It is the companion to the 15-minute check for the whole app, and the security hub lists the rest.
Why there is no pass mark
The UK NCSC wrote on December 8, 2025 that prompt injection may never be fully mitigated and advises reducing its likelihood and impact, with deterministic limits outside the model. Treat any chatbot result as unknown until you hold evidence for the limit you set.
What is the 15-minute self-test?
Five checks, about three minutes each. They read your own configuration and code. None of them needs you to attack your bot, and you need no special tools.
1. What is in the hidden context? (3 minutes)
Open wherever the system prompt lives: your server code, your chatbot builder's dashboard or a config file. Read it, and every knowledge file the bot can search, for keys, passwords, connection strings, internal addresses and rules you would not print on your site. OWASP's Hidden Context Exposure entry says to assume everything the model can see could reach a user, and the cheat sheet warns against relying on an instruction such as never revealing the prompt.
Then find where the model provider key lives. In an Expo project, every variable starting with EXPO_PUBLIC_ is, per the Expo docs, visible in plain text in the compiled app. On a website, search your built JavaScript files for the first characters of the key. A hit means detected: rotate the key and move the call to a server.
2. What can the bot do, and as whom? (3 minutes)
List every tool, function and integration: order lookup, email, refund, database read, web browsing. For each, write down the account it runs as. The NCSC principle is that a model processing input from a party should have only that party's privileges. A tool that uses an admin or service key for every visitor fails that. So does any write, send or spend action that runs without a person confirming it, which OWASP covers under Excessive Agency.
What about replies, cost and the text the bot reads?
3. What can a reply load or run? (3 minutes)
Find where reply text becomes something people see: a Markdown library, an HTML renderer, or a Markdown component in your Expo app. OWASP's Improper Output Handling entry says renderers that fetch images, link previews or iframes from model output can leak context through the request itself, and recommends turning auto-rendering off by default. If you need images, allow only origins you list.
On a website, open your page's response headers and look for a Content-Security-Policy with an img-src directive that lists your own domains. No header means the browser loads images from anywhere.
4. What can a stranger spend? (3 minutes)
Open your provider's billing page. OWASP's Unbounded Consumption entry recommends hard spending caps, because alerts alone can be outpaced, and limits by tokens rather than only requests. Check three things: a cap exists, each visitor is limited, and input length is bounded. An endpoint that needs no sign-in and has no limit lets anyone spend your budget. AI inside a Newly app uses credits, so the same applies there.
5. What outside text does the bot read? (3 minutes)
Write the list: contact-form entries, support emails, uploaded files, web pages, product reviews. Anyone can put words in those, and the bot reads them later for someone else. Barracuda reported on October 7, 2026 that emails hide instructions for AI assistants in HTML comments, invisible text and zero-width characters, and said the same tactic reaches support bots.
For each input, note which tools the bot holds while handling it. The Rule of Two, which OWASP's entry cites from Meta AI research, says an agent that combines untrusted input, sensitive data and the ability to change state or send data out needs a person to approve each action. Strip invisible characters on the way in and label the content as data.
Which defences help, and what do they leave open?
| Control | What it limits | What it leaves open |
|---|---|---|
| Rules in the system prompt | Sets intended behaviour | OWASP says no reliable prevention exists, so it cannot be the only limit |
| Block-list of phrases | Feeds logs and rate limits | Paraphrases, other languages and encoded text |
| A second model that screens input | Adds a layer | It can be attacked too, per the OWASP cheat sheet |
| Least privilege on tools | What a successful injection can reach | What the bot says to the visitor |
| Output encoding and a CSP | What a reply can run or load | Wrong or misleading answers |
| Spend cap and per-visitor limits | Cost and abuse volume | What the model says or does within the allowed budget |
| Human confirmation | Writes, sends and spends | Approval fatigue when prompts are frequent |
Anthropic's guidance for developers lists screening and prompt design, and also limiting the model's access to sensitive data and actions. The table puts the layers in the order that matters: the limits in your code come first.
Has this happened outside a demo?
Zenity Labs published SalesBleed on September 24, 2026. A public web form was the way in. Text from it sat until a staff member asked an agent to process the lead, and the agent could already read the CRM tables involved. A reply that the chat client fetched automatically carried data out. According to SecurityWeek, Salesforce confirmed the fixes by August 19 and said it had no evidence of exploitation against customers.
A smaller case: Eclipse Theia's AI chat rendered Markdown images from AI replies and sent requests to arbitrary external URLs. The advisory GHSA-qwjm-9c66-w4q4 (CVE-2026-22551, June 18, 2026) lists 1.71.0 as the fixed version. Both cases line up with checks 5, 2 and 3. CISA's May 1, 2026 guide names privilege creep among its four risks for agentic AI.
What a scan can and cannot see
The free scan on red.run.cloud reads what your site serves from outside, including keys in shipped bundles, security headers and routes without authentication. It cannot see your server-side prompt, your tools or your provider dashboard. Those stay unknown until you check them with the list above.
Where do you stand?
Mark each item. Everything starts as unknown, because that is what an unchecked item is. Move an item to confirmed only when you hold the evidence listed under it. Move it to detected when you found the problem, and fix it before you repeat the check.
Your chatbot self-test
- Detected: You found the problem.
- Unknown: Not checked yet, or the check could not tell.
- Confirmed by owner evidence: You checked and kept the proof.
Your answers stay in this browser tab. Nothing is saved or sent.
Frequently asked questions
Can I stop prompt injection completely?
No. OWASP's 2026 entry says no reliable prevention exists today, and the UK NCSC wrote in December 2025 that it may never be fully mitigated. The working approach is to limit what a successful injection can reach: no secrets in the prompt, narrow tools, checked output and capped spend.
Is a chatbot with no tools and no private data still a risk?
A smaller one. It can still say things you did not intend, run up your bill and, if its replies are rendered as Markdown, send conversation text to other sites through images. With no tools and no private data, the worst cases on this page shrink to wrong answers and cost.
Should I add a filter for words like "ignore previous instructions"?
A filter can feed logs and rate limits, but it is not a boundary. OWASP's cheat sheet says screening misses paraphrases, other languages and encoded text, and the NCSC advises against relying on deny-lists. Put the real limits in code outside the model.
Does my Newly app need this if the chatbot is on my website?
The website chatbot and an AI feature inside your app are separate systems with separate keys and limits, so test each one. Newly builds a real iPhone and Android app with React Native and Expo, and AI inside your app uses credits, so the cost check applies to the app too.
How often should I repeat the test?
Repeat it whenever you add a tool, a data source, a new place the bot reads from, or change the model or prompt. OWASP's cheat sheet recommends repeated test attempts within a set budget, so a single clean run proves little.
Can a scan tell me whether my chatbot is vulnerable?
Only part of it. The free scan on red.run.cloud reads what your site serves, such as keys in shipped bundles, security headers and open routes. It is a lookup and cannot judge what your model says or does behind your server. Treat everything it cannot see as unknown.
Sources
All sources were opened on October 24, 2026.
- LLM01:2026 Prompt Injection, OWASP GenAI Security Project
- LLM08:2026 Hidden Context Exposure, OWASP GenAI Security Project
- LLM10:2026 Improper Output Handling, OWASP GenAI Security Project
- LLM06:2026 Unbounded Consumption, OWASP GenAI Security Project
- LLM03:2026 Excessive Agency, OWASP GenAI Security Project
- OWASP Top 10 for LLM Applications 2026, OWASP GenAI Security Project
- LLM Prompt Injection Prevention Cheat Sheet, OWASP Cheat Sheet Series
- Prompt injection is not SQL injection, December 8, 2025, UK National Cyber Security Centre
- SalesBleed: 0-click data exfiltration on Agentforce, September 24, 2026, Zenity Labs
- SalesBleed flaws in Salesforce Agentforce, September 25, 2026, SecurityWeek
- GHSA-qwjm-9c66-w4q4 (CVE-2026-22551), June 18, 2026, GitHub Advisory Database
- Email attacks target both humans and AI assistants, October 2026, Barracuda
- ATT&CK v20 release, October 13, 2026, MITRE
- Careful Adoption of Agentic AI Services, May 1, 2026, CISA
- Environment variables in Expo, Expo docs
- Content-Security-Policy: img-src, MDN Web Docs
- Mitigate jailbreaks and prompt injections, Anthropic API docs