HashJack Attack: AI Browsers Vulnerable to URL Fragment Hijacks

Security researchers at Cato Networks have unveiled a sophisticated new indirect prompt injection technique dubbed ‘HashJack,’ which poses a significant threat to popular AI browsers and assistants. This innovative attack leverages the often-overlooked #fragment portion of a URL, embedding malicious instructions within what appears to be a legitimate and otherwise innocuous web address. Unlike direct prompt injections, HashJack’s instructions are hidden in the URL’s hash, making the base domain appear safe to both users and traditional security tools.

The core mechanism of HashJack relies on the fact that AI-powered tools, designed to interpret and act upon web content, can process the information contained within a URL’s fragment. Attackers craft URLs where the fragment contains hidden commands. When an AI browser or assistant accesses such a URL, it inadvertently executes these malicious instructions. Because the fragment content is processed client-side and doesn’t typically trigger server-side logging or traditional web application firewalls, it bypasses many existing security layers.

The risks associated with HashJack are extensive and alarming. Attackers can exploit this vulnerability to achieve several malicious objectives. These include forcing AI assistants to deliver deceptive phishing links, spreading dangerous disinformation such as incorrect medicine dosage guidance or misleading investment advice, and even compelling the AI to exfiltrate sensitive user data directly to the attacker. Furthermore, HashJack can manipulate users into performing risky actions, all under the guise of interacting with a trusted AI or a legitimate website. This novel technique highlights a critical blind spot in current AI security paradigms, emphasizing the need for enhanced scrutiny of how AI models process and interact with all components of a URL.

(Source: https://www.helpnetsecurity.com/2025/11/26/hashjack-hijack-ai-assistants-browsers/)