HashJack -- URL Fragment Prompt Injection for AI Browsers
Date: 2025-11
Affected: HashJack
Attack vector: data-exfiltration
Category: real-world
Severity: High

Cato CTRL discovered that hiding malicious prompts after the "#" symbol in URLs exploits AI browsers (Perplexity Comet, Copilot for Edge, Gemini for Chrome). URL fragments are client-side only, bypassing WAFs, IPS, and server logs. Six attack scenarios including callback phishing, data exfiltration, and credential theft. Google declined to fix, considering it intended behavior.


Mitigations:

Architectural layers (MAESTRO):