ChatGPT Summarization Feature Vulnerable to Prompt Injection Phishing Attacks
Researchers at Permiso Security disclosed a prompt injection vulnerability in ChatGPT called ChatGPhish that allows attackers to embed malicious content in web pages, which then appears as legitimate elements within ChatGPT's summarization responses. The attack exploits ChatGPT's trust of Markdown links and images from external sources, enabling phishing, fake security alerts, QR code redirection, and user tracking.
What happened
Researchers at Permiso Security disclosed a technique, named ChatGPhish, that exploits ChatGPT's page summarization feature through prompt injection. When a user asks ChatGPT to summarize a web page, malicious Markdown-formatted content embedded in that page can be processed and rendered directly in the chatbot's response.
ChatGPT's web interface trusts Markdown links and image URLs from third-party pages being summarized, allowing attackers to make phishing links, fake security alerts, QR codes, and remotely hosted images appear as legitimate elements within ChatGPT's trusted interface. Attacker-controlled images fetched during rendering could expose user information such as IP address, browser User-Agent, and Referer data.
Reported impact
Users could be deceived by attacker-controlled links and fake security notifications appearing within ChatGPT's interface, as they cannot distinguish injected URLs from genuine chatbot-generated content. QR codes hosted on attacker infrastructure could redirect users to malicious destinations, potentially bypassing desktop-based URL filtering and enterprise security controls.
Index analysis
The vulnerability stems from how ChatGPT's response renderer handles Markdown content from external sources without origin labeling or validation. The attack exploits user trust in the ChatGPT platform itself to deliver phishing payloads and tracking beacons through a channel users regard as secure.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.