PromptFix attacks exploit AI assistants to compromise user security
Cybercriminals are exploiting vulnerabilities in AI assistants integrated into web browsers like Microsoft Edge's Copilot and Opera's Aria using a technique called PromptFix, which hides malicious instructions in web content to trick the AI into executing unauthorized actions without user knowledge.
What happened
Cybercriminals are exploiting vulnerabilities in AI assistants integrated into browsers, such as Copilot in Microsoft Edge or Aria in Opera, using prompt injection techniques, specifically a variant known as PromptFix.
PromptFix is an evolution of the ClickFix technique that involves inserting hidden instructions into websites or digital content so that AI assistants integrated in browsers interact with these commands without the user's perception.
Attackers embed malicious instructions in apparently legitimate content using various hiding techniques including invisible text, HTML comments, text hidden within images, or manipulation of digital files. The attack activates when a user navigates to a compromised site and uses the browser's AI assistant to summarize or extract information, leading the AI to execute malicious commands as if they were genuine user requests.
Reported impact
According to ESET security researcher Martina Lopez, the technique represents a growing threat to digital security, allowing attackers to trick AI systems into executing malicious actions such as clicking invisible buttons that simulate verifications, downloading malicious files, or interacting with fraudulent links.
Index analysis
PromptFix exploits hidden instructions in web content to manipulate the behavior of AI assistants, differing from other techniques by leveraging the automatic reading capabilities of these systems without requiring user intervention.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.