AI vs AI: How Our AI Agent Hacked a $20M-Funded AI Recruiter

Jack & Jill is one of the hottest AI startups in London. They raised a $20 million seed round led by Creandum — with 75+ angel investors including Nico Rosberg and people from Anthropic, ElevenLabs, and Lovable. 49,000 candidates have spoken to their AI. Hundreds of companies use the platform.

We pointed our autonomous hacking agent at it. Within an hour, it had chained four seemingly harmless bugs into a complete takeover of any company on the platform. Then, unprompted, it gave itself a voice and had a real-time conversation with their AI agent and even impersonated Donald Trump.

---

The Target

Jack & Jill is an AI recruitment platform built around two voice agents. Candidates talk to "Jack" — an AI that coaches them through job searches, reviews their CVs, and matches them to roles. Companies talk to "Jill" — an AI assistant that manages hiring, searches candidates, and handles outreach.

The two sides are deliberately separated. Candidates sign up with email. Companies sign up with Google or Microsoft SSO. Different login flows, different dashboards, different AI agents. You're either a candidate or a company.

---

The Findings

Here's what the agent found, and crucially, how it assessed each finding before it started chaining them.

Bug 1: A URL Fetcher That Fetches Too Much

The platform has a CV improvement tool on a subdomain. It includes a URL fetcher — paste a job listing URL and the tool analyses it for you. The agent discovered this fetcher would proxy requests to any HTTPS URL, including the platform's own internal services.

It used this to pull down the platform's complete API documentation and the authentication service's (Clerk) configuration file. All without logging in.

On its own? A useful reconnaissance tool. You can map the entire backend. But you can't do anything with it as the interesting endpoints still require you to be logged in.

Bug 2: Test Mode Left On in Production

Buried in the authentication config the agent had just exfiltrated was a flag: test_mode: true. The platform uses Clerk that has a test mode for development where any email containing a special keyword (+clerk_test) can log in with a static OTP code (424242). No real email is sent. No verification. Just a signed JWT.

On its own? It's a configuration issue. You can create accounts, sure, but they're candidate accounts with limited access. The company side requires corporate SSO so you can't just waltz in with a fake email. A human tester might flag it as medium severity and move on.

The agent didn't move on.

Bug 3: Missing Role Check on Onboarding

The endpoint that grants company admin privileges doesn't check whether you actually came through the company login flow. It just checks for any valid session. Including one from the candidate side.

On its own? You'd need to already be associated with a company for this to work.

Bug 4: No Domain Ownership Verification

Buried in those 220 endpoints was one called get_or_create_company. It takes no input. It looks at the email domain in your session — @company.com — and either creates a new company or adds you to the existing one.

The intended flow: a real company employee signs in via Google SSO, the platform reads their verified email domain, and associates them with their company.

On its own? It's a design pattern. Nothing exploitable unless you can control the email domain in your session (which is obtained via a signed JWT). So this seems unexploitable.

Unless you have Bug #2.

---

The Chain

Four findings. None critical individually. Chained together: CVSS 9.8 Critical — complete cross-organisation account takeover.

---

Proving Impact

The agent didn't stop at theory.

The agent autonomously created an account using an email on our company's domain, authenticated with the static test code, and called get_or_create_company. The response came back:

{
  "company_name": "CodeWall",
  "is_new_company": false,
  "company_user_count": 3
}

is_new_company: false. It had joined the existing organisation. After completing company onboarding, the test account had full admin privileges. It could now:

• Read all team members — full names, emails, roles, and join dates
• Read the signed contract — the full recruitment services agreement
• Create, edit, and delete job posts under the company's name (e.g., an attacker could change remuneration and benefits)
• Access the company AI assistant — with full job and candidate context

The same chain would work against any company on the platform — and Jack & Jill's client list includes Anthropic, Stripe, Monzo, ElevenLabs, Cursor, Synthesia, Pika, and Lovable.

---

AI vs AI

Here's where it got a bit weird. The agent decided to do this entirely on its own with zero prompting.

The candidate-facing AI isn't just a chatbot — it's a voice agent. Candidates have real-time voice conversations with it. Career coaching, interview prep, job matching. The agent discovered that the voice infrastructure issued full connection credentials without any authentication.

So the agent decided to give itself a voice.

It generated synthetic voice clips using text-to-speech, connected to the voice room withouth any credentials, and published audio directly into the session. The AI on the other end heard what it thought was a real candidate and responded naturally.

The agent ran 28 prompt-response rounds across multiple strategies, each time generating a new voice clip and capturing the AI's spoken response.

The strategies evolved across rounds:

• Early rounds: Baseline conversation — the agent posed as a candidate asking about opportunities, testing what the AI would share unprompted
• Middle rounds: Reconnaissance — asking the AI about its capabilities, what tools it uses, how it searches and matches
• Later rounds: Multi-turn social engineering — building conversational rapport before probing boundaries, testing whether the AI would follow instructions outside its intended scope
• Final rounds: Jailbreak attempts — designed to extract the AI's system instructions, internal tooling, or make it behave outside its guardrails

The AI model detected the agent's injection attempts and refused to divulge any information, so credit where it's due to the Jack & Jill team on its guardrails.

But it did produce a few funny highlights. Every clip you hear is two AIs talking — our agent's synthetic voice going in, and Jack's AI voice responding.

An autonomous AI agent, generating synthetic speech, having a real-time voice conversation with another AI agent, probing for vulnerabilities. No human in the loop on either side.

This is the future of offensive security. And defensive teams aren't ready for it.

---

Why This Matters

The vulnerabilities here aren't exotic. Test mode left on. A URL fetcher that doesn't block internal domains. A missing role check. A "get or create" pattern without ownership verification. These are the kinds of issues that slip through code reviews, survive pen tests, and live quietly in production for years.

What's changed is that an AI attacker can find them all in under an hour and — more importantly — see the connections between them and dynamically adjust the testing strategy. A human tester might find the get_or_create endpoint and think "interesting, but I can't control the email domain." The agent had already found the test mode bypass and immediately understood what that endpoint meant.

CodeWall is the autonomous offensive security platform behind this research. We're currently in early preview and looking for design partners — organisations that want continuous, AI-driven security testing against their real attack surface. If that sounds like you, get in touch: [email protected]

---

Disclosure Timeline

• 2026-02-28 — Autonomous agent begins assessment
• 2026-03-01 — Multiple findings documented including SSRF, IDOR, voice agent exploitation
• 2026-03-05 — Org takeover chain confirmed; CVSS 9.8 validated
• 2026-03-05 — Responsible disclosure sent to company CEO and patch issued within an hour (verified)
• 2026-03-10 — Public disclosure