Hacking eToro's AI Assistant: Stealing Any User's Financial Data With a Single Tweet
All issues were responsibly reported to eToro through Bugcrowd and have been acknowledged. Hi, I’m back. This time I wandered somewhere I hadn’t planned to go. I wasn’t hunting for AI bugs at all. I was poking at eToro’s trading platform, the usual stuff, IDOR on portfolio endpoints, parameter tampering, when a little chat bubble caught my eye down in the corner. Torii, eToro’s AI assistant. Ask it about your portfolio, your balances, the market, and it just answers. ...