Use AI browsers? Be careful. This exploit turns trusted sites into weapons - here's how

Follow ZDNET: Add us as a preferred source on Google. Researchers have revealed a new attack technique, dubbed HashJack, that can manipulate AI browsers and context windows to send users malicious content. HashJack is the name of the newly discovered indirect prompt injection technique outlined by the Cato CTRL threat intelligence team. In a report published on Tuesday, the researchers said this attack can "weaponize any legitimate website to manipulate AI browser assistants." Also: AI doesn't just assist cyberattacks anymore - now it can carry them out The client-side attack technique abuses user trust to access AI browser assistants and involves five stages: Cato says that in agentic AI browsers, such as Perplexity's Comet, the attack "can escalate further, with the AI assistant automatically sending user data to threat actor-controlled endpoints." As an indirect prompt injection technique, HashJack hides malicious instructions in the URL fragments after the # symbol, which are then processed by a large language model (LLM) used by an AI assistant. This is an interesting technique as it relies on user trust and the belief that AI assistants won't serve malicious content to their users. It may also be more effective as the user visits and sees a legitimate website -- no suspicious phishing URL or drive-by downloads required. Also: How AI will transform cybersecurity in 2025 - and supercharge cybercrime Any website could become a weapon, as HashJack doesn't need to compromise...