DeepSeek AI: From Prompt Injection To Account Takeover · Embrace The Red

DeepSeek AI's recently released reasoning model, DeepSeek-R1-Lite, has garnered significant attention in the AI community. The post describes how the author used pentesting techniques to exploit Cross-Site Scripting (XSS) and prompt injection vulnerabilities, demonstrating a potential account takeover scenario. The vulnerability was reported and fixed promptly by DeepSeek. The post provides insight into the security risks in LLM-powered web apps and the importance of secure session handling.