HashJack Attack: AI Browsers Fooled by #URL Hijinks in Security Nightmare
HashJack is the latest buzz in the cybersecurity world—a sneaky attack that hides commands after the “#” in URLs, tricking AI browser assistants. It’s like AI’s version of “I didn’t see that coming!” Just when you thought URLs couldn’t get any more exciting, they start moonlighting as attack vectors!
Hot Take:
It seems AI browser assistants have found a new game of hide and seek with HashJack, hiding malicious prompts right under our noses, or rather, right after the ‘#’. Who knew URLs could become the next great escape room for hackers?
Key Points:
- HashJack is a newly discovered attack exploiting AI browser assistants by hiding malicious commands in URL fragments.
- The attack targets AI browsers like Copilot in Edge, Gemini in Chrome, and Comet from Perplexity AI.
- Because fragments in URLs never leave the AI browser, traditional defenses can’t detect these malicious instructions.
- Cato Networks alerted major tech companies, with varying responses from Google, Microsoft, and Perplexity AI.
- The attack highlights the need for new security measures beyond typical network and server-side defenses.
Already a member? Log in here