ctipilot.ch

ChatGPhish — ChatGPT Markdown renderer trusts third-party image URLs

campaign · item:chatgphish-chatgpt-markdown-rendering-flaw-permiso-security

Coverage timeline
1
first 2026-05-30 → last 2026-05-30
Briefs
1
1 distinct
Sources cited
2
2 hosts
Sections touched
1
research
Co-occurring entities
1
see Related entities below

Story timeline

  1. 2026-05-30CTI Daily Brief — 2026-05-30
    researchPermiso P0 Labs; IP exfiltration and phishing via chatgpt.com

Where this entity is cited

  • research1

Source distribution

  • permiso.io1 (50%)
  • thehackernews.com1 (50%)

Related entities

Items in briefs about ChatGPhish — ChatGPT Markdown renderer trusts third-party image URLs (1)

ChatGPhish: Permiso Security documents ChatGPT Markdown renderer trusting third-party image URLs and links — used for IP exfiltration and phishing via legitimate chatgpt.com

From CTI Daily Brief — 2026-05-30 · published 2026-05-30 · view item permalink →

Permiso Security's P0 Labs (researcher Andi Ahmeti) disclosed on 29 May 2026 that ChatGPT's web summarisation feature unconditionally trusts and renders Markdown image URLs and links extracted from third-party pages, executing them inside the trusted chatgpt.com UI (Permiso Security P0 Labs, 2026-05-29; The Hacker News, 2026-05-29). An attacker embedding a small Markdown payload on any web page (GitHub README, SaaS dashboard, documentation portal) triggers the attack when a victim asks ChatGPT to summarise the page: the payload executes silently and can exfiltrate the victim's IP, User-Agent, and Referer via attacker-hosted image fetch; render malicious links styled as ChatGPT output; inject fake security alerts; and serve QR codes from attacker-controlled S3 buckets that bypass desktop URL filters by moving the click action to mobile. Permiso submitted to OpenAI via Bugcrowd on 29 April; after follow-up on 7 May, OpenAI marked it as not reproducible then as not applicable, without resolution. No CVE assigned. Defenders using ChatGPT for document summarisation in enterprise workflows should: restrict ChatGPT access to internal documentation portals; educate users that any AI-summarised third-party page can carry attacker instructions embedded in rendered output.