HashJack Indirect Prompt Injection Weaponizes Websites

HashJack is an indirect prompt-injection vulnerability that embeds malicious instructions in URL fragments (the part after '#') which AI-powered browsers can process locally, allowing attackers to manipulate browser assistants to exfiltrate data, inject phishing links or misinformation, fetch malicious payloads, or perform actions on the victim’s system; traditional network and server defenses do not see URL fragments, increasing the attack's stealth. Cato Networks reported the issue and noted fixes deployed by some vendors (Perplexity, Microsoft) while others (e.g., Gemini for Chrome at the time of reporting) remained unpatched.