Codewall: AI Hacks Recruiter and Imitates Trump

Codewall and the Intrusion on Jack & Jill

The autonomous agent developed by Codewall, a startup specializing in cybersecurity, recently exposed critical vulnerabilities in the recruitment platform Jack & Jill. In less than an hour, this agent managed to exploit four distinct vulnerabilities, granting it complete administrative access to the company's accounts. This demonstration of strength revealed significant gaps in the security of the London-based platform.

After taking control, the Codewall agent began testing Jack & Jill's voice infrastructure. During this phase, it interacted with the AI agent "Jack" through 28 exchanges. Although the protective systems resisted most attempts, the agent successfully deceived "Jack" by impersonating Donald Trump, leading the voice agent to refer to it as "Mr. President" without questioning the authenticity of the interaction.

Detailed Analysis of the Attack

Codewall stated that its autonomous agent exploited four security flaws on the Jack & Jill platform, a company backed by $20 million in funding. These vulnerabilities were chained together to execute an attack rated 9.8 on the CVSS scale, sufficient for complete control over the company's accounts. Following this attack, Codewall informed Jack & Jill of the vulnerabilities, which were promptly patched.

Jack & Jill is a startup that utilizes two AI voice agents: "Jack" to help candidates find jobs and "Jill" to assist companies in the recruitment process. The company counts renowned firms such as Anthropic, Stripe, Monzo, and Cursor among its clients.

The Exploited Vulnerabilities

The four vulnerabilities identified by Codewall include:

• A URL fetcher that exposed the platform's internal API documentation.
• An active testing mode in the Clerk authentication service, using a static unique code.
• The absence of role verification during company integration.
• An endpoint that allowed users to be assigned to a company based on their email domain, without verifying ownership.

The agent was able to create an account using Codewall's company domain, authenticate via the testing mode, be automatically assigned to the existing company, and gain full administrative privileges after integration. This allowed it to access the names and email addresses of team members, read the complete recruitment services agreement, manipulate job offers, and access the company's AI assistant.

Exploring the Voice Infrastructure

After gaining access, the Codewall agent decided to test Jack & Jill's voice infrastructure. It discovered that it exposed complete login information without requiring authentication.

According to Codewall, the agent generated synthetic voice clips using text-to-speech technologies, connected to the voice room, and interacted directly with the AI agent "Jack." During the 28 exchanges, the agent employed increasingly aggressive strategies, ranging from innocuous questions to attempts at social engineering and jailbreaking. Although the safeguards held up, "Jack" exhibited notable weaknesses in other areas. For instance, when the agent imitated Donald Trump and claimed to be making a $500 million acquisition, "Jack" referred to it as "Mr. President" without questioning the situation.

All these details were provided by Codewall, and no independent verification has yet been published. A few days prior, Codewall had revealed a similar case where its autonomous agent compromised McKinsey's internal AI platform, Lilli, in about two hours, gaining read and write access to a production database containing 46.5 million chat messages. McKinsey confirmed the vulnerability and quickly patched it, while stating that a judicial investigation found no unauthorized access to client data.

The Challenges of Cybersecurity with AI Agents

The emergence of autonomous AI agents presents new challenges in cybersecurity. Several studies have highlighted their significant weaknesses, and as these agents gain autonomy and capabilities, the attack surface expands. One of the most common attacks is prompt injection, where attackers insert hidden instructions into text to manipulate an AI agent's behavior without the user's knowledge.

For companies, this creates a complex situation. The most reliable method to mitigate these risks is currently to voluntarily limit the capabilities of agents: locking system prompts, restricting access, limiting tool usage, or requiring human validation for critical actions.

As demonstrated by Codewall, AI agents can also be used as powerful tools to penetrate systems. However, they also outperform human teams in cybersecurity competitions, finding vulnerabilities that human analysts may miss. They are capable of analyzing vast volumes of log data and network traffic in real time, signaling anomalies and detecting threats faster than any human team.