ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
Researchers say ChatGPT can render attacker-controlled links and images from summarized pages, creating a phishing surface inside the assistant UI.
Intelligence analysis by GPT-5.4 Mini
Permiso Security says a flaw in ChatGPT's web-summary rendering can turn a normal page summary into a phishing vehicle. By hiding instructions and assets in a page, an attacker may get clickable links, remote images, IP leakage, and QR-code lures displayed inside the trusted chat interface.
A smart helper is supposed to make web pages easier to read. But researchers say a bad page can hide tricks that make the helper show dangerous links and pictures.
That is like asking a friend to read a flyer, and the flyer secretly makes the friend hand out bad phone numbers with the notes. The friend looks trustworthy, so people may not notice the trap.
The worry is that people trust the helper window. If a fake warning or QR code appears there, someone might click it or scan it even though the original page was risky.
Analysis
What Permiso found
Permiso Security says it identified a technique it calls ChatGPhish in ChatGPT's web summary flow. The issue is not a classic link-spam problem; it is that the renderer appears to trust Markdown links and image URLs taken from a third-party page that ChatGPT just summarized.
How the attack works
According to the report, an attacker can hide a small payload in a page that a victim later asks ChatGPT to summarize. When the assistant renders the response, it may auto-fetch attacker-hosted images and display links as live, clickable elements inside the assistant UI. That can leak the victim's IP address, user agent, and referer data when images load. The same mechanism can also surface fake security warnings and QR codes that point to attacker infrastructure.
Why this is a phishing problem
Permiso's point is that the trusted AI interface becomes the delivery layer. A user does not need to open a malicious attachment or even recognize a suspicious email. Summarizing a web page during normal browsing activity may be enough to introduce attacker-controlled instructions into the model context and then into the visible answer.
The article also places this finding alongside other recent AI attack research, including work on prompt injection, AI coding agents, and malicious repositories that can lead to code execution. The broader theme is clear: as assistants become more capable and more connected, their output surfaces can become part of the attack path, not just their input surfaces.
Key points
- Permiso Security says ChatGPT's summary renderer can trust links and images from summarized pages too much.
- Attackers may be able to make ChatGPT show clickable phishing links, fake alerts, remote images, and QR codes.
- Image fetches can leak visitor details such as IP address, user agent, and referer.
- The issue matters because it moves phishing into a trusted AI interface used for browsing and research.
- The article links this finding to a broader wave of attacks against AI models and coding agents.
