Case hashjack-url-fragmentPrompt injectionIsrael
HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome
Cato CTRL showed instructions in a URL fragment, which never reaches the server, are read by AI browser assistants and can push phishing links or make agentic browsers leak data. Perplexity and Microsoft patched it.
MediumAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Nov 25, 2025
- Location
- Israel
- Target
- Perplexity Comet, Copilot in Edge, Gemini in Chrome
- Severity
- Medium
- Triggered by
- Cato CTRL threat research
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Cato CTRL showed instructions in a URL fragment, which never reaches the server, are read by AI browser assistants and can push phishing links or make agentic browsers leak data. Perplexity and Microsoft patched it.
Impact: Phishing, disinformation and data exfiltration via trusted sites; no in-the-wild abuse reported
Who triggered it
Actor: Cato CTRL threat research
Attribution: Responsible disclosure to Perplexity (July 2025) and Google and Microsoft (August 2025)
Motive: Security research
How it happened
Attack vector: Indirect prompt injection via client-side URL fragments on legitimate websites
Root cause: Assistants ingested the full URL including fragment as context
Timeline
- Cato reports to Perplexity
- Cato reports to Google and Microsoft
- Public disclosure
Response
Perplexity and Microsoft shipped fixes; Google rated it low severity and intended behaviour
Current status: Patched
Sources (open in a new tab)
- The Register theregister.com
- Help Net Security helpnetsecurity.com
- Infosecurity Magazine infosecurity-magazine.com
Cite this case
HashJack: prompts hidden in URL fragments hijack Comet, Edge Copilot and Gemini in Chrome. AI Threat Watch, case hashjack-url-fragment, Nov 25, 2025. https://aithreat.io/cases/hashjack-url-fragment/
Permanent link: https://aithreat.io/cases/hashjack-url-fragment/