Security researchers have discovered a new indirect prompt injection vulnerability that tricks AI browsers into performing malicious actions.
Cato Networks claimed that “HashJack” is the first vulnerability of its kind able to weaponize any legitimate website in order to manipulate browsers like Comet, Copilot for Edge and Gemini for Chrome.
The malicious prompts are hidden in the text that comes after the “#” symbol in legitimate URLs. While AI browsers process this piece of text, web servers never see it.
The full link can be shared via email or social media, or embedded on a webpage. If the victim clicks through and loads the page, there’s nothing malicious to see. However, if they fire up an AI browser to ask a relevant question, it could trigger the threat actor’s instructions, Cato Networks claimed.
The threat is a serious one as URL fragments never leave the AI browser, so traditional network and server defenses like intrusion detection systems (IDS) don’t see them. Any website can be turned into an offensive tool in this way, with even cautious users likely to be fooled.
“HashJack works by abusing user trust. Because the malicious fragment is embedded in a real website’s URL, users assume the content is safe while hidden instructions secretly manipulate the AI browser assistant,” Cato Networks explained.
“In agentic AI browsers like Comet, the attack can escalate further, with the AI assistant automatically sending user data to threat actor-controlled endpoints.”
Several Scenarios
Cato Networks said threat actors could use HashJack to achieve a variety of goals. These include:
- Telling the AI browser to add security/support links pointing to threat actor phone numbers/WhatsApp groups for callback phishing
- Telling an agentic AI browser assistant to fetch a malicious URL and add user/victim context including account names, numbers and email addresses for data exfiltration
- Injecting misinformation into AI browser responses to make it look like they came from the legitimate site
- Directing the AI browser to carry out malicious actions like opening ports or downloading packages that contain malware
- Instructing the AI browser to insert a threat actor-controlled login link into responses for credential theft
Cato Networks said that, as of November 25, Perplexity and Microsoft had applied fixes for their Comet and Copilot for Edge browsers, but that the issue remained unresolved in Gemini for Chrome.
It added that HashJack didn’t work on Claude for Chrome and OpenAI’s Atlas.