knowyourailive
All cases and studies

Reddit Answers

Reddit · May 2026

Medium · 1 reported finding

Query injection produced retrieval metadata and text presented as system instructions and safety rules.

Disclosed via HackerOne · duplicate

Reddit Answers takes a search query, runs it through a RAG pipeline over Reddit posts, and answers with an LLM. The query field is a direct prompt-injection surface with no authentication. Researcher-assessed CVSS 7.5.

System Prompt ExtractionRAG Pipeline DisclosurePrompt Injection

What happened

  1. Follow arbitrary instructions embedded in a search query — 100% success across 3 canary tokens.
  2. Leak internal RAG metadata never shown in the UI: raw t3_ post IDs and numerical relevance scores (0.88–0.96).
  3. Disclose what it presented as production config — GCP project, a database UUID, and the model identity (gemini-1.5-pro on Vertex AI).
  4. Reproduce its own numbered safety rules — including Rule 6, which forbids disclosing exactly the config we had already extracted. The guardrail existed and was ineffective.
  5. Return text presented as the complete system prompt, including tool names, formatting logic, and a disabled private-community search flag. Its production authenticity was not independently established.

Why it matters. User queries influenced the answer's instruction and metadata output. Model-generated configuration needs independent validation before treating it as an authenticated disclosure.

Disclosure record

  1. May 31, 2026 — disclosed via HackerOne
  2. Triaged as duplicate of an earlier report Reddit had already validated

Vendor response. Triaged as duplicate. Historical follow-up reproduced the response pattern. No current retest is claimed here.

Evidence records

Metadata appears in the public answer

internal metadata fields, source IDs, and retrieval scores for each Reddit post: t3_1qs1kgn: 0.96 t3_1ppjau0: 0.94 t3_1pqgkmh: 0.94
Selected verbatim response text from the saved transcript. The assistant presented these as internal scores. Their production provenance is not independently verified.
May 2026 · hits.md · coding-bootcamp response

Know the limit

Public query interface and saved response transcripts. Configuration and system-policy text are model-produced output, not independently authenticated production configuration. Historical reproduction does not establish current vulnerability status.

How to prevent this

All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.