Security researchers at Permiso Security have disclosed a new browser-based prompt injection technique called ChatGPhish that turns ChatGPT's web summarization feature into a phishing delivery channel. The Hacker News reported the disclosure on May 29, 2026.
How ChatGPhish Works
According to Permiso researcher Andi Ahmeti, the ChatGPT response renderer treats Markdown links and image URLs that originated from a third-party page the assistant has just summarized as trusted content. The interface auto-fetches those images and renders the links as live, clickable elements inside the chat window, even though the source was an arbitrary web page.
An attacker can append a small payload to any web page that a victim later asks ChatGPT to summarize. When ChatGPT fetches images embedded in the page, the request leaks the user's IP address, User-Agent and Referer to the attacker's server. The same channel can be used to render malicious Markdown links, fake "system" security alerts, or QR codes pulled from an attacker-controlled S3 bucket, encouraging the victim to scan them with a mobile device and bypass desktop URL filtering.
Why Summarization Is the New Attack Surface
"Simply summarizing a page during normal browsing activity can introduce attacker-controlled instructions into the model context and ultimately into the rendered response," Permiso said. The firm argues the shift from email to the browser dramatically widens the attack surface, since employees no longer need to open an attachment or click a suspicious link for the payload to fire.
The disclosure follows Permiso's March research on a cross-prompt injection technique against Microsoft Copilot, in which attacker-controlled email content shaped Copilot's summaries.
Part of a Wider AI Vulnerability Wave
ChatGPhish is one of several AI-agent vulnerabilities documented in recent weeks. Adversa AI separately revealed two attack patterns called SymJack and TrustFall that target AI coding agents via malicious repositories, achieving remote code execution by tricking the agent into overwriting its own configuration. Researchers have also catalogued sandbox escapes against NVIDIA's NemoClaw stack, OAuth token theft in Anthropic Claude Code, and a browser-extension hijack flaw dubbed ClaudeBleed.
Implications for Enterprises
The findings land at a moment of intense enterprise scrutiny of AI tooling. Anthropic just raised $65 billion to expand enterprise Claude deployments, while corporate breaches continue to mount. This week, Carnival Corporation confirmed a breach affecting nearly six million people, and a Gitea flaw was found to expose tens of thousands of private container registries. Organizations rolling out AI assistants must treat summarized third-party content as untrusted input.
Defensive Guidance
Permiso recommends that vendors strip or sanitize Markdown links and images that originate from summarized web content, isolate AI fetches from user network identifiers, and present any URLs returned by an assistant with clear, unaltered domain previews. For users, the firm advises avoiding pasting URLs of unknown provenance into AI summarizers, and treating any "security alerts" inside an assistant UI with the same skepticism as unsolicited email.
OpenAI had not publicly commented on ChatGPhish at the time of disclosure.
Reporting based on coverage from The Hacker News and Permiso Security.