Rein Security has disclosed a chain of security vulnerabilities affecting the AI shopping assistant of an unnamed major retailer, claiming the flaws expose structural security weaknesses in enterprise AI agents that rely primarily on large language model (LLM) gateway protections.

According to the company's Agent Breakers research team, the vulnerabilities were identified on March 12, 2026, during an independent effort to evaluate the security of large-scale enterprise AI deployments. The AI assistant, which is available across multiple platforms, helps shoppers discover products, compare items, answer shopping questions and navigate the retailer's catalog through natural language interactions.

The researchers said the project was intended to demonstrate that security approaches centered on LLM gateways, which inspect prompts entering a model and responses leaving it, are insufficient for protecting AI systems that perform complex decision-making and backend actions.

The investigation began with the assistant's product comparison feature, which researchers observed could retrieve content from external websites. According to Rein Security, that observation led to the development of a five-stage exploit chain executed entirely through the application's public mobile interface without privileged access.

Researchers said the assistant uses a standard chat interface with follow-up suggestions and a "Sources" feature that identifies external websites used to generate responses. While the system appeared to include an intent-classification layer to limit conversations to shopping-related topics, Rein Security said those protections were not consistently applied across all user inputs.

The report argues that LLM gateways cannot observe internal tool invocations, API calls, content retrieval or the sequence of actions taken after a prompt has been accepted. It also states that gateway models themselves remain susceptible to prompt manipulation, leaving them unable to detect attacks that occur after requests pass intent classification.

Based on decrypted HTTPS traffic analysis, Rein Security said requests from the retailer's mobile application were routed through the retailer's backend before interacting with a major cloud provider's enterprise AI search infrastructure for retrieval-augmented generation.

The researchers conducted testing in a controlled Android emulator using tools including Frida, Burp Suite Pro, a custom certificate authority certificate and cURL. Rein Security said no production systems were modified, no user data beyond the researchers' own testing session was accessed and no denial-of-service conditions were intentionally triggered.

According to the report, the retailer's primary chat interface included stronger intent filtering than the application's standard search field, which researchers identified as the primary injection point. Rein Security said this difference enabled the search function to bypass the intent-classification layer and potentially serve as an unprotected path for malicious instructions.

The company outlined a five-stage exploit chain that began with indirect prompt injection through the product comparison feature, allowing retrieval of attacker-controlled external content. Researchers then identified differences in how search queries were processed, disclosed internal prompt context and tool information, constructed a payload that they say resulted in remote code execution within the agent's backend environment and identified Google Maps API keys exposed in decrypted mobile application traffic.

Rein Security said the vulnerabilities required no privileged access or infrastructure compromise and could be exploited through the same interface used by everyday shoppers.

The company reported the vulnerabilities to the retailer through responsible disclosure on March 13, 2026. As of July 16, 2026, when the report was published and after what Rein Security described as a 90-day disclosure window, the company said the vulnerabilities had not been remediated. The retailer's identity was withheld for legal reasons.

In discussing the broader implications, Rein Security said enterprise AI agents present security challenges that extend beyond traditional gateway protections because they increasingly perform workflows, make customer-facing decisions and interact with sensitive systems. The company argued that organizations deploying AI agents should move beyond traffic inspection and implement visibility into agent execution and behavior to better secure autonomous systems.