How I Hacked Denmark

Right as I was looking for the best type of paper for printing the Prompt Injection Handbook for my bachelor thesis defense, I got the email telling me I got a full-ride scholarship and stipend for IT University of Copenhagen. This marked the start of this short compilation of what I did since I arrived to Denamrk, without breaking any NDA(s) or listing technical details for pages on and on. There’s also a big chunk of work not in here at all, some private bug bounty engagements and a couple of other projects I don’t have the privilege to discuss publicly. What’s below is everything I can actually stand behind with my name attached. Huge thanks to professors Carsten Schürmann and Alessandro Bruni for advising me on the legal end of most of my projects.

Looking back, what stands out isn’t the CVSS scores. It’s that these projects actually went somewhere. Bugs got fixed, research turned into open-source tools, companies reached out afterward, and in one case I literally walked out with free cake because a payment bug worked exactly as expected.

In my firt year I took the the course Ethical Hacking where we were encouraged to actually contact and hack a real company (legally). This was my second semester in Denmark and I was still a big shut-in who didn’t know much about the country yet, so I went on Google Maps to look at what companies even existed around me. Not thinking much about it, I stumbled across Lagkagehuset (part of the Ole & Steen group) and just shot them an email about collaborating. I was surprised how quickly they responded. They were super chill during the whole thing. I had a signed vulnerability disclosure agreement and an NDA with Lagkagehuset, scope was their public site and ordering flow, and I was given about two months to find whatever I could.

Testing took around a few hours. I presented four solid findings, but the ones they cared about most were a request replay bug and a price manipulation bug. The app calculated prices client side and trusted whatever number came back in the request, so you could intercept the checkout and drop the price to basically nothing before it hit the payment processor. On top of that, a legitimate purchase request could just be replayed with a different order number to generate additional “paid” orders in the system without any actual payment going through.

This wasn’t just proven on paper either. In the course we were actually looking at Danish criminal law, and between that and some legal reading I’d already done on my own in the past, I knew how to structure the signed VDP so it explicitly covered “ordering and/or picking up items in reasonable amounts” as in scope. That let me actually test it in real life and walk out with free cakes and matcha coffees. Going to physically pick it up felt like a legal spy mission. All of this got reported to the company, and once it was confirmed and fixed, they rewarded me with a few thousand DKK worth of gift cards, “so you can get your cakes legally now” as they joked when handing them over.

Breaking bank

Same semester, right as I was putting together the presentation for the Ethical Hacking exam, a message popped up in the ITUnderground Discord: “Danske Bank Jailbreaking.” I already had quite some experience with jailbreaking and had been jokingly called “head of jailbreaking” in the club, so when I saw it while procrastinating on studying for an algorithms exam the next day, I figured why not.

I can’t go into the specifics of what I did there since I work there now and it involves their chatbot, but the short version is it was a system prompt extraction that chained into other problems from there. My jailbreak ended up winning the hackathon and eventually led to a job offer. I still had an algorithms exam the next morning and somehow managed to pass it too.

By third semester it felt like things were starting to snowball. MCPs were becoming a big thing, so I’d been messing with Claude Desktop’s MCP integration as a side project, mostly out of curiosity about how much trust gets extended to a local server just because it’s speaking the protocol correctly. That curiosity turned into a full research paper, “Living Off the Land with Model Context Protocol: Visibility, Consent and Privilege Escalation Risks in Claude Desktop,” which ended up getting the max grade.

The core idea is that MCP servers are becoming the AI equivalent of living off the land binaries. The same properties that make a compromised PowerShell or curl dangerous (trusted, pre-installed, blends into normal activity) apply just as well to a compromised local MCP server, except now the “system” it’s living off is an LLM client with a user’s full local permissions behind it.

That talk put a question in my head: what about education? Universities are infrastructure too, not in the traditional sense of power lines and water treatment, but in a functional sense. They certify competence. A medical degree from a Danish university tells the health system that a person can practice medicine. If the systems underpinning those certifications are compromised, the signal becomes meaningless. Despite how important exam platforms are, offensive security research targeting them is sparse. The most notable prior work is Burgess et al.’s 2022 paper, which reverse engineered four U.S. proctoring suites and found all their anti-cheating measures could be trivially bypassed.

My thesis was originally going to be titled “How to Cheat on an Exam.” The plan was genuinely to sit an exam using techniques I’d find, film the whole thing as a bit of a vlog, and turn it into research with a stunt element, partly because I thought it would be funny and partly because exam security felt like a topic nobody was taking seriously enough to actually poke at properly. My supervisor said no to the exam-taking part, for reasons that in hindsight are extremely fair, so it turned into a straight vulnerability research project on exam and LMS infrastructure instead, working with UNIwise on their platform.