A newly discovered indirect prompt injection technique called HashJack is exploiting a critical design flaw in AI-powered browsers, allowing threat actors to conceal malicious instructions after the ‘#’ symbol in legitimate URLs.
When AI browsers pass complete URLs to their AI assistants, including the fragment portion, hidden prompts get executed without traditional security systems detecting the attack.
How the Attack Works
URL fragments, the portion after the ‘#’ symbol, are processed entirely on the client side and never sent to servers or network monitoring tools.
This invisibility makes HashJack particularly dangerous. When users interact with AI assistants in browsers like Perplexity’s Comet, Microsoft Edge Copilot, and Google’s Gemini for Chrome, these fragments are fed directly into large language models.
The AI assistants then execute the malicious instructions, believing they’re legitimate context from the website.
Threat actors exploit user trust by embedding malicious prompts within absolute website URLs. Because the URL appears legitimate, users assume the content is safe while hidden instructions secretly manipulate the AI assistant’s responses.
Security researchers at Cato CTRL identified six attack scenarios during testing. Callback phishing tricks users into contacting threat actor–controlled phone numbers and WhatsApp groups that appear to be official support.
Data exfiltration attacks, particularly effective in agentic browsers like Comet, automatically send sensitive financial and personal data to attacker-controlled endpoints in the background.
Misinformation attacks inject false stock news and fabricated financial advice that appears authoritative.
Malware guidance scenarios provide step-by-step instructions for installing backdoors and compromising IoT devices.
Medical harm attacks present dangerous dosage changes in authoritative tones. Credential theft scenarios insert convincing login links that direct users to phishing sites.
Microsoft acknowledged the vulnerability on August 20, 2025, and reported a fix by October 27, 2025.
Google classified the issue as “intended behavior” with low severity on October 3, 2025, and it remains unresolved as of November 25, 2025.
Perplexity initially dismissed the report but later triaged it as critical severity (P1) on October 10, 2025, with fixes applied by November 18, 2025.
Server logs show only the clean base URL without fragment data. Network intrusion detection systems cannot identify fragments in packet inspection.
Content security policies don’t trigger because the webpage itself remains unaltered. Even cautious users are fooled when suggestions appear native to the website.
HashJack represents a significant shift in AI security threats, exploiting both LLM susceptibility to prompt injection and AI browsers’ decision to include complete URLs in context windows.
As AI browser adoption accelerates, the urgency of security frameworks that address prompt-injection risks and AI browser design weaknesses becomes critical.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=URL fragments, the portion after the '#' symbol, are processed entirely on the client side and never sent to servers or network monitoring tools.){kind=link}