ChatGPT Bug Lets Attackers Turn Web Pages Into Phishing Payloads

Key Takeaways

• A new prompt injection technique, dubbed “ChatGPhish,” allows attackers to turn any web page into a phishing payload via ChatGPT’s summarization feature.
• The attack leverages ChatGPT’s trust in third-party content, enabling the display of malicious links, fake security alerts, and QR codes within the AI’s interface.
• Permiso researchers disclosed the vulnerability to OpenAI, which was initially deemed unreproducible and later a duplicate, before public disclosure on May 29, 2026.
• The issue highlights a fundamental challenge for browser-integrated AI summarization, requiring vigilance and specific mitigation strategies from users and organizations.

A sophisticated browser-based prompt injection method has emerged, transforming ordinary web pages into potent phishing delivery mechanisms. This technique exploits ChatGPT’s page summarization capabilities, allowing threat actors to embed and render malicious content directly within the AI’s trusted interface. This enables the display of attacker-controlled links, fabricated security alerts, and even QR codes.

Researchers at Permiso have detailed this novel attack, branding it “ChatGPhish.” The method builds upon the “trust-transfer” logic previously demonstrated against Microsoft Copilot, where carefully crafted email content could manipulate AI-generated summaries through Cross Prompt Injection Attacks (XPIA).

ChatGPhish significantly expands this threat by moving beyond email to the broader browser environment, where users spend much of their digital lives. Any web page a user asks ChatGPT to summarize—be it a GitHub README, a documentation portal, a blog post, or a SaaS dashboard—can silently carry malicious instructions that influence the AI’s response.

ChatGPT Vulnerability – ChatGPhish Attack

By embedding a concise instruction payload into any publicly accessible web page, an unauthenticated attacker can dictate how ChatGPT structures and renders its summarization output. This manipulation is possible because chatgpt.com‘s response renderer implicitly trusts Markdown links and image URLs sourced from the summarized third-party content.

This trust model opens the door to several distinct attack primitives:

• UI Redress / Phishing: Attacker-controlled Markdown links appear as live, clickable elements within the ChatGPT interface without any origin labeling. Users are unable to differentiate between legitimate, AI-generated URLs and those injected by an attacker.
• Spoofed System Alerts: Malicious text can be styled to mimic legitimate “account security” notifications, leveraging the visual credibility of the assistant’s own UI to trick users.
• QR-Code Pivot: Automatically rendered QR code images, fetched from attacker-controlled S3 buckets, bypass standard desktop URL defenses such as hover previews, browser blocklists, and password manager domain checks. The malicious destination only becomes apparent after scanning the QR code on a second device.
• Passive Tracking Beacon: Markdown images embedded via URL shorteners (e.g., shorturl.at) are automatically fetched upon every render. This action leaks the victim’s IP address, User-Agent, Referer header, and high-resolution timing data to infrastructure controlled by the attacker.

The inherent danger of ChatGPhish lies not merely in the injection itself, but in where the compromised output is presented. As highlighted by OWASP LLM01:2025, a core risk of prompt injection is the inability of Large Language Models (LLMs) to reliably distinguish between genuine instructions and attacker-supplied content embedded within retrieved data. Once processed, this attacker-controlled content surfaces within the ChatGPT response window, styled identically to authentic assistant output, complete with formatted alerts, clickable links, and inline images.

The browser’s same-origin policy offers no protection because the AI assistant operates within the user’s authenticated context, rendering traditional web security boundaries ineffective.

Disclosure and Response

Permiso initially submitted a vulnerability report to OpenAI via Bugcrowd on April 29, 2026, detailing “Untrusted Markdown Rendering Leads to XSS, Phishing, and Data Exfiltration.” OpenAI’s initial response indicated that the report could not be reproduced. A revised submission on May 1, 2026, which included expanded proof-of-concept steps, was subsequently classified as a duplicate of a previously reported issue.

Following further communication on May 7, 2026, clarifying the broader implications for phishing, QR-code attacks, and passive tracking, the research was publicly disclosed on May 29, 2026. The ChatGPhish research underscores a fundamental structural challenge confronting all browser-integrated AI summarization systems: as long as attacker-controlled web content can influence rendered assistant output without explicit origin labeling, the browser remains a practical, low-barrier attack surface for phishing, device pivoting, and passive reconnaissance.

What You Should Do

• Exercise Caution with Summarization: Avoid using AI browser summarization features on web pages that may contain user-generated or untrusted content, such as Reddit, public GitHub READMEs, or personal blogs.
• Restrict AI Browser Permissions: Grant AI browser extensions only the absolute minimum necessary permissions. Require human approval before interacting with any links within summarized responses.
• Verify All Links and Alerts: Treat any clickable link, image, or alert appearing within an AI summary as potentially attacker-controlled until its origin attribution is clearly and explicitly displayed by the AI assistant.
• Implement Enterprise Controls: Deploy semantic input/output filtering and anomaly detection mechanisms on AI-integrated surfaces within enterprise environments.
• Monitor AI Activity Logs: Regularly review AI browser activity logs for any unexpected outbound image fetch requests directed to unknown or URL-shortened endpoints, which could indicate passive tracking attempts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.