Artificial intelligence has become a layer of trust for millions of users who use it daily to summarize articles, review documentation, understand code, research complex topics, or navigate information faster. But that same layer of trust is beginning to open up a new front of risk. Research published by Permiso warns that any web page a user asks ChatGPT to summarize could become a vehicle for phishing if malicious content manages to slip into the response displayed by the assistant's own interface.

What ChatGPhish is and why it raised alarms

The technique was dubbed ChatGPhish and points to a problem that goes beyond classic *prompt injection*. According to the report by Permiso researcher Andi Ahmeti, the risk is not only that the model can be influenced by malicious instructions embedded in a page, but that this information ends up being presented within an environment the user perceives as trustworthy: the ChatGPT window.

That nuance significantly changes the significance of the finding. The problem is not just what the AI “reads,” but how it then “displays” it. If users see links, alerts, or visual resources integrated into an assistant's response, they are more likely to perceive them as legitimate, even when they come from attacker-controlled content.

How a web page can become a payload

The research describes a scenario in which an attacker adds a small malicious payload to the content of a public page. That page could be a README on GitHub, a documentation page, a blog post, or a seemingly legitimate landing page. If the victim visits that content and then uses a ChatGPT summarization feature from the browser, that material could influence the model's output.

According to Permiso, if the system takes external content and then renders it within the assistant's response without clearly separating which part came from the original site and which part was actually generated by the AI, it creates a dangerous transfer of trust. In the demonstration published by the firm, Firefox served as the entry point to activate the “summarize page” workflow, although the researchers clarify that this should not be interpreted as a vulnerability in the browser itself. The real problem would lie in the design of the workflow between reading, summarization, and rendering.

The risks: fake links, misleading alerts, and QR codes

The report identifies several specific vectors. One is the most obvious: malicious links rendered as clickable within the assistant's response. Another is the appearance of fake alerts that look like legitimate messages, written with a tone and presentation that may seem to be part of ChatGPT's own environment.

A third important risk also emerges: the use of remote images and QR codes. Permiso maintains that automatically loaded images could function as tracking beacons, leaking data such as IP, User-Agent, Referer, and the time at which the response was rendered. In the case of QR codes, the problem is even more delicate because it shifts the attack from the desktop to the phone. A victim could scan a QR code from the assistant's interface and end up on an attacker-controlled site, bypassing several common desktop browser defenses.

Why this case matters beyond ChatGPT

What makes this story especially relevant is that it is not limited to a specific bug or an isolated product. The news brings a broader problem back into focus: more and more AI assistants are functioning as an intermediate layer between the user and the web.

That means it is no longer enough to think about malicious pages, suspicious emails, or dangerous downloads. We must now also consider what happens when an AI scrapes, summarizes, rearranges, and presents external content within a conversational interface. If that layer inherits visual and functional trust, it also inherits value for an attacker.

Coverage by The Register underscored precisely this point, noting that AI products are increasingly starting to resemble a browser or even a scaled-down operating system, with more capabilities, more context, and therefore a larger attack surface. Meanwhile, The Hacker News stressed that a seemingly normal website could turn ChatGPT into a new phishing surface.

What the researchers said and where the case stands

Permiso included a disclosure timeline indicating that it initially reported the problem to OpenAI on April 29, 2026, through Bugcrowd. It subsequently submitted an expanded version of the finding on May 1, with more reproduction details and greater context about the problem's impact. Finally, the firm published the research on May 29.

According to that same report, the case was first marked as “not reproducible” and then as a duplicate. The Register added that it had not obtained public confirmation from OpenAI on whether the problem had already been fully fixed at the time of its coverage. That detail is important because it helps avoid overreacting: the story is serious, but it also requires precision about the actual state of mitigation.

The lesson for users and businesses

For ordinary users, the conclusion is simple: not everything that appears within an AI response should automatically be treated as trustworthy content. The fact that something is inside a clean, familiar, conversational interface does not mean that it originated with the assistant or that it is safe to click.

For businesses, security teams, and developers, the conclusion is broader. Content retrieved from the web must be treated as untrusted input. If a system summarizes pages, renders Markdown, automatically loads images, or displays links within an AI interface without sufficient separation of origins, it can become a new distribution layer for phishing, tracking, and manipulation.

A problem of trust, not just cybersecurity

The promise of AI assistants is to save time, reduce friction, and simplify complex tasks. But for precisely that reason, they can also reduce the warning signs that previously helped users detect threats. And that is where the real significance of ChatGPhish lies: it is not just a cybersecurity story, but a warning about how risk changes when user trust shifts from the open web to a conversational interface.

As more people use AI to research, summarize, and decide which link to open, the design of those experiences stops being a product detail and becomes a security issue. If external content is not clearly separated from the assistant's response, convenience can become a vulnerability.

Verified sources

- Permiso: Source
- The Hacker News: Source
- The Register: Source
- Cyber Security News: Source