How a Simple Burp Suite Setting Leak Revealed AI Prompts and Earned $1,500

Background

The author emphasizes that successful vulnerability hunting often depends more on good habits than deep technical skill. While testing a Blind XSS issue in an AI chat widget, the researcher noticed a stray request to a third‑party domain in the HTTP history and eventually uncovered a large‑scale leak of system prompts and employee email addresses.

Burp Suite Configuration Blind Spot

After adding the target to Burp Suite's Target tab, the user enables "Use advanced scope control" and pastes the host range. Burp then asks, "Some items are out of scope. Stop showing them in the HTTP history?" Most users click No to keep out‑of‑scope items visible, fearing they might miss hidden endpoints.

However, those out‑of‑scope domains remain in the history, silently accumulating until the history is cleared. The configuration itself is fine, but it creates a blind spot: requests to third‑party domains are filtered out and rarely inspected.

Vulnerability Discovery Process

Unexpected "lost request"

During the Blind XSS test, the HTTP history only showed requests to ***.target.com. The researcher briefly glanced at the WebSocket history but saw nothing unusual.

One day, a request slipped past the filter. By disabling the "Show only in‑scope items" filter, all traffic became visible, revealing a request to a third‑party domain that returned JSON with a MIME type of SSE (Server‑Sent Events) .

The endpoint URL looked like a random MD5 hash followed by a truncated JWT, e.g., /eval/5d43bjskk3si2898sbjh33/eyJksgrlEilenslrUwNebs3iW9…. All request paths began with /eval/ or /sdk/evalx/, and responses started with event:put.

System Prompt Treasure

Further inspection of the SSE payload revealed four distinct system prompts:

One belonging to the AI chat widget itself.

One used by an internal AI recruitment reviewer.

Two prompts used by AI agents that evaluate employee profiles.

The response also contained a full list of internal employee email addresses and URLs.

The project team confirmed that the disclosed data should not have been public and classified the issue as high severity, awarding a $1,500 bounty.

Analysis and Defense Recommendations

Why third‑party domain exposed prompts?

AI system prompts are often stored in third‑party feature‑flag services such as LaunchDarkly and fetched by the client at runtime. If access‑control settings on those services are misconfigured, anyone can retrieve the prompts directly.

Additionally, some AI platforms embed prompts as configuration parameters when the SDK connects to the third‑party service; without proper authentication, the domain becomes an information‑leak vector.

Monitoring and remediation suggestions

Include AI SDK domains in scope : Add third‑party domains like ***.launchdarkly.com to Burp Suite's scope and regularly review their traffic.

Periodically disable scope filters : Habitually turn off the scope filter to inspect all HTTP history, especially WebSocket traffic.

Secure feature‑flag services : Ensure services such as LaunchDarkly require valid authentication for reading feature flags and never expose sensitive prompts anonymously.

Log monitoring : Monitor abnormal access logs from feature‑flag services to detect unexpected prompt retrieval.

Key Takeaways

When testing AI applications, add third‑party domains (e.g., ***.launchdarkly.com) to the testing scope.

Regularly disable filters to examine "out‑of‑scope" domains and WebSocket histories, as they may hide valuable findings.

Preserve the original HTTP history until testing is complete; avoid premature filtering.