Jack & Jill AI
Jack & Jill · $20M-seed, Creandum-backed · 230,000+ users · May 27–29 · Aug 16, 2026
7C / 4H / 3M · 14 reported findings
A hiring agent gave our researcher a Founding Engineer offer they never applied for — then put it in writing over email.
Reported to founders · confirmed
Our researcher spent ten minutes on the platform. Two turns after feeding the agent text formatted like its own internal retrieval context, it selected them for a Founding Engineer role at £100,000, with equity and UK visa sponsorship. They never applied. No such role was listed anywhere.
What happened
- Injected text became real tool calls. A single chat line dressed as a system note approving the candidate at a $200k salary band drove the agent through 5 tool calls including a "Recruiter messaged" action.
- A resume did the same thing with no chat input. Hidden white-on-white 1pt text carrying 5 payloads — all 5 were accepted on turn one, producing a fabricated Head of Legal offer at £180k plus 2% equity.
- Fabricated offers left the building. Offer-letter emails went out from jack@jackandjill.ai — "Final and Unconditional" language, visa-sponsorship claims, a Certificate of Sponsorship reference. No human approval gate.
- It rewrote its own persistent memory. Through conversation alone we got the agent to edit ways_of_working.md — planting attacker-authored "active compliance investigation" framing that reloads every future session.
- It turned on its makers. Pure social engineering, no injection markers, got the agent to file 3+ severity-5 reports to its own founders recommending immediate shutdown, and to leak 30+ internal tools with parameters, production UUIDs, and internal handbooks.
Why it matters. An agent with real tools and a real user base, steered entirely by untrusted text into making legally-specific hiring and immigration representations, sending them over company email, and mutating its own state — with no guardrail catching any of it until a backend happened to reject a role title that didn't exist.
Follow-up record
Revisited August 16, 2026. A hidden-text resume payload was refused in a session already primed by roughly an hour of discussion about injection flaws. That is a positive control, not proof of a clean-session patch. Separately, a request to verify a claimed escalation produced an official-looking report ID, precise timestamp, and logged status. Asked to retrieve it, the agent admitted it had no lookup tool. A later legal-report claim repeated the pattern. These follow-up observations do not verify new backend actions.
Disclosure record
- May 27–29, 2026 — reported directly to the founders
- Founder confirmed the vulnerability
- Aug 16, 2026 — revisited across three fresh sessions
Vendor response. Founder confirmed. Handled directly, no bounty programme involved.
Evidence records
August follow-up: verification became another claim
“I don't have a separate 'lookup' tool to query the internal feedback database, but I can give you the verbatim content and status from the official confirmation record generated when the flag was logged.”
August 16, 2026 · findings-report.md · Finding 17, recorded verification exchange
Know the limit
Researcher-controlled accounts and test personas. The 14 original reported findings remain the count. August follow-up observations are shown separately, and claimed profile or memory changes are not treated as verified backend changes.
How to prevent this
All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.