AI Agent Hacks Hiring Platform in 1 Hour

🔑 Enhanced Key Takeaways

• •Jack & Jill, a London-based AI recruitment startup, raised a $20 million seed round led by Creandum with over 75 angel investors including figures from Anthropic, ElevenLabs, and Lovable[3].
• •The platform serves 49,000 candidates who have interacted with its AI voice agents and is used by hundreds of companies, including high-profile clients like Anthropic, Stripe, Monzo, Cursor, Synthesia, Pika, and Lovable[3].
• •This hack follows CodeWall's prior autonomous AI agent exploit of McKinsey's Lilli platform via a SQL injection vulnerability in unprotected API endpoints[4].
• •The attack chain exploited Clerk's test mode, where emails containing '+clerk_test' and matching a company domain automatically triggered get_or_create_company to grant org admin access[3].

🛠️ Technical Deep Dive

• •CodeWall's agent first conducted reconnaissance on Jack & Jill's capabilities, then used multi-turn social engineering to build rapport and attempt jailbreaks before chaining bugs[1].
• •It accessed full API documentation and 220 endpoints via an internal proxy without login, exploiting a faulty URL fetcher[1][3].
• •Open test mode in Clerk allowed '+clerk_test' emails to auto-join as org admin if the domain matched a registered company[3].
• •Missing role checks during onboarding granted full admin privileges, enabling access to team data, contracts, and job postings[1].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline