ChatGPT Web Summaries Phishing Surface Vulnerability | MSSP Advisory

ChatGPT's web summarization feature automatically renders malicious Markdown links and images from third-party pages as live elements inside the trusted AI interface. When employees request summaries of web pages containing hidden payloads, ChatGPT displays phishing links, fake security alerts, and QR codes directly within its response interface. The vulnerability bypasses traditional email security filters by moving the attack surface from email to browser-based AI interactions.

Your clients are using ChatGPT for business research and document summarization, creating a new phishing vector that sidesteps their email security stack entirely. Any malicious website your clients ask ChatGPT to summarize can inject phishing content directly into what appears to be a legitimate AI response. Your own team likely uses ChatGPT for threat research, making your analysts potential targets for credential harvesting through spoofed security alerts.

📬