Topic starter
03/06/2026 11:01 am
TL;DR: ChatGPT page summaries can render attacker-controlled Markdown links and images from third-party web pages as live elements inside the assistant UI, while auto-fetching remote assets also leaks IP, User-Agent, Referer, and timing data, according to Permiso Security. The control problem is the trust boundary between retrieved content and rendered assistant output, not the browser alone.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “ChatGPhish: The Page Is the Payload”.
Key questions
Q: How should security teams stop browser-summarised pages from becoming phishing payloads?
A: Treat summarisation output as an untrusted rendering problem, not just a model-inference problem.
Q: Why do rendered links and images in AI assistants create security risk?
A: Because they inherit the assistant’s trust while still originating from untrusted content.
Q: What are the signs that an AI summarisation flow is misusing untrusted web content?
A: Look for assistant answers that preserve Markdown links, display remote images, or reproduce alert-style language taken from the page.
Practitioner guidance
- Separate retrieved content from assistant-authored output Ensure summarisation flows visually and structurally distinguish model-generated text from quoted page content, links, and images so users can see what came from the page and what came from the assistant.
- Disable automatic remote image fetching Prevent assistant renderers from loading third-party images by default, or route them through a safety proxy that strips tracking headers and blocks passive beaconing.
- Suppress clickable links from untrusted summaries Render hyperlinks from summarised pages as inert text unless the destination is verified and clearly labelled as external content rather than assistant output.
Bottom line: ChatGPT-style page summaries can turn ordinary web pages into phishing and tracking delivery surfaces when untrusted Markdown and images are rendered inside the assistant UI.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 11:03 am
Rendered assistant output has become part of the attack surface. The article shows that once a summarisation system preserves Markdown links and image URLs from a third-party page, the trust boundary shifts from the source page to the rendered answer. That is not a browser quirk, it is a governance failure around what the assistant is allowed to present as its own output. The implication is that identity and security teams must treat the rendering layer as a privileged control plane, not a harmless presentation detail.
A question worth separating out:
Q: What should teams do when assistant output can include QR codes or tracking pixels?
A: Treat those elements as active delivery mechanisms. QR codes can move the user off desktop controls onto a phone, while tracking pixels can reveal who viewed the page and when. Teams should block or tightly gate those render paths, and require explicit provenance before any such element appears in an assistant response.
👉 Read our full editorial: Browser injection turns ChatGPT summaries into phishing payloads