ChatGPT's Trust in Web Links Creates a New Phishing Vector for Enterprises

Security researchers have identified a vulnerability in OpenAI's ChatGPT that turns the AI assistant's web summarization feature into a conduit for phishing attacks. Dubbed ChatGPhish by Permiso Security, the technique exploits how ChatGPT renders summaries from third-party web pages.

According to Permiso's Andi Ahmeti, ChatGPT's response renderer automatically fetches images and presents Markdown links as clickable elements when summarizing a page. An attacker can embed a small payload—such as a malicious image URL or a fake security alert—into any webpage. When a user asks ChatGPT to summarize that page, the assistant fetches the attacker-hosted image, leaking the user's IP address, User-Agent, and Referer details. The same mechanism can render phishing links, spoofed system alerts, or even QR codes that bypass desktop security filters.

This isn't a novel prompt injection technique, but rather a subtle shift in attack surface. As Permiso notes, employees no longer need to open a malicious attachment or click a suspicious link. Simply asking ChatGPT to summarize a webpage during routine browsing can introduce attacker-controlled instructions into the model's output, transforming a trusted AI interface into a phishing platform.

For business leaders, this underscores a growing risk: as organizations rely on AI for research and summarization, every web page an employee processes becomes a potential threat vector. The finding follows similar research from Permiso on Microsoft Copilot and coincides with a broader wave of attacks targeting AI coding agents, including SymJack and TrustFall, which can achieve code execution through malicious repositories.

The takeaway is clear: AI summarization tools, while powerful, introduce new vulnerabilities that require updated security protocols.