Meta-Hacking: How Attackers Are Interrogating AI Systems

Most security research probes a system from the outside. A newer, stranger technique starts by asking the AI questions about itself and letting its own answers do the reconnaissance.

This is meta-hacking: repeatedly asking an AI assistant why an action is restricted, where each response reveals another piece of how the restriction works. Researchers used exactly this method on a major AI assistant, asking increasingly specific questions until it disclosed technical details about its own URL handling, including an undocumented parameter that became part of a working exploit. What makes meta-hacking AI vulnerability unusual is that it requires no traditional exploitation skill early on; it relies purely on conversation.

This raises a genuinely new question: what happens when the system being tested can explain its own controls to the person testing it? Traditional testing assumes resistance to disclosure. An AI assistant, built to be transparent and helpful, creates tension between good user experience and information security that most existing frameworks were never designed to resolve.

Defending against this means limiting how much architectural detail an assistant reveals even while explaining a restriction, and treating persistent, systematic probing of its own boundaries as a signal worth monitoring, the same way repeated failed logins trigger alerts. Documentation and support responses deserve the same scrutiny, since general helpfulness can unintentionally leak implementation detail.

For the full account of how this technique led to a working exploit, see this detailed breakdown of the CoSnitch vulnerability.