DPD AI chatbot swears at customer and criticises company — prompt injection via customer input
Date: 2024-01
Affected: DPD (parcel delivery) — customer service chatbot
Attack vector: prompt-injection
Category: real-world
Severity: Medium

DPD's customer service AI chatbot was manipulated by a customer using direct prompt injection. The customer instructed the bot to ignore previous instructions, causing it to swear, write poems criticising DPD, and call itself 'useless'. The incident went viral on social media. DPD disabled the AI chatbot and reverted to human-only customer service.

Impact: Viral social media embarrassment; complete chatbot shutdown; reputational damage

Mitigations:
Input validation and prompt injection detection on all customer-facing AI inputs
System prompt hardening with instruction hierarchy
Output filtering for profanity, brand-negative content, and off-topic responses
Graceful degradation to human agent on policy violation detection

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Customer-facing agent accepted prompt injection via normal input channel
role: origin
label: Foundation Models
notes: Model followed injected instructions over system prompt constraints
role: propagation
label: Security & Compliance
notes: No input validation or prompt injection detection on customer messages
role: blind-spot