Permiso Security has disclosed a vulnerability in ChatGPT's response renderer that turns the AI assistant's summarization feature into a phishing surface. Dubbed ChatGPhish, the attack exploits ChatGPT's implicit trust in Markdown links and images sourced from third-party pages it summarizes.
When a user prompts ChatGPT to summarize a web page, the renderer automatically fetches images embedded in that page and renders Markdown links as clickable elements. An attacker can append a small payload to any page—adding attacker-hosted images or malicious links—that executes when the summary is rendered. This leaks the user's IP, User-Agent, and Referer headers, and can display fake security alerts or QR codes that bypass desktop URL filters.
What makes this notable is not the prompt injection itself, but the delivery mechanism. Unlike traditional phishing requiring a user to open an attachment or click a suspicious link, ChatGPhish activates during normal browsing: an employee asks ChatGPT to summarize a page, and the malicious payload renders inside the trusted assistant UI. As organizations increasingly rely on AI for research and summarization, any web page fed to ChatGPT becomes a potential attack vector.
Permiso previously demonstrated a similar cross-prompt injection against Microsoft Copilot via email summaries. The shift from email to browser expands the attack surface significantly—no user interaction beyond a legitimate summarization request is required.
This disclosure arrives alongside a wave of AI-targeted vulnerabilities: SymJack and TrustFall attacks against AI coding agents achieve remote code execution by tricking agents into overwriting config files or auto-approving malicious MCP servers. Other findings include jailbreaks via multi-turn conversations, extension hijacking in Claude's Chrome extension, and typographic prompt injections that bypass vision model filters.
For engineering teams, the takeaway is clear: treat AI assistant rendering pipelines as untrusted surfaces. Validate and sanitize any content sourced from external pages before rendering, and consider restricting auto-fetching of remote resources in assistant responses.
Source: The Hackers News