A user clicks a link that reads chatgpt.com/share/[hash]. The certificate is valid. The favicon is the right one. The page tells them ChatGPT is having an outage and they need to install a desktop client to keep their session active. They install it. They are now compromised, and your endpoint protection has nothing to flag because the URL came from one of the most-trusted domains in their corporate browser history.

That’s the new shape of the ChatGPT abuse story this week, and it’s a cybersecurity problem that conventional URL filtering, brand-impersonation training, and email security stacks are not built to catch. The page comes from chatgpt.com itself, served from OpenAI’s own share infrastructure. The same week, researchers at Permiso Security disclosed “ChatGPhish,” a separate vulnerability in how chatgpt.com renders Markdown links and images inside model responses, which lets an attacker plant a phishing surface inside an AI-generated web summary the user explicitly asked for.

Two unrelated abuse patterns. One platform. Same lesson: when your users trust the domain more than the content, the content becomes the attack.

The platform is the lure now

The share-link abuse, first detailed by BleepingComputer, works like this. Threat actors generate a ChatGPT conversation in which the assistant produces text and a button presenting itself as an “outage status” or “desktop client install.” They share the conversation, which mints a chatgpt.com/share/ URL. They distribute that link through ads, social posts, and convincingly themed landing pages. The victim sees a chatgpt.com URL, sees a familiar ChatGPT layout, and follows the prompt to download a malware-laden installer.

This is a feature working as designed. Share links exist so users can show off conversations, and the share surface inherits the platform’s full domain trust. There is no meaningful content moderation on what a shared conversation suggests the user do next. Your secure web gateway is not going to block chatgpt.com. Your phishing training said to check the URL. The URL checked out.

ChatGPhish puts the injection inside the answer

Permiso’s ChatGPhish disclosure is technically different and arguably more interesting. ChatGPT’s response renderer implicitly trusts Markdown links and images returned in model output. When a user asks the assistant to summarize a web page, the assistant fetches and processes external content, and an attacker who controls that page can plant prompt-injection text plus crafted Markdown that ends up rendered as clickable links and inline images inside the model’s response.

The victim asked the AI a question. The AI responded with what looks like a helpful summary and a relevant link. The link goes to an attacker-controlled domain. From the attacker’s perspective, the user explicitly initiated the interaction, which means most behavioral threat detection looking for unsolicited link clicks will see this as legitimate user activity.

Both patterns share the same defender problem. Brand impersonation rules don’t fire. Sender reputation doesn’t fire. The user is using a sanctioned AI tool in a sanctioned way, and the tool is delivering the payload.

What this changes about your cybersecurity playbook

Treat AI assistant traffic as its own egress category instead of general web. Your network telemetry should be able to answer “what destinations did our users reach in the sixty seconds after they touched chatgpt.com?” If you can’t reconstruct that pivot, you have no shot at incident response for AI-mediated phishing. First-seen destinations downstream of AI tool sessions belong in your alerting tier, not in a weekly report nobody reads.

Application allowlisting needs to mature past signer trust. The malware in the share-link campaign is being packaged as a “ChatGPT desktop client,” and users will not pause to verify a signature chain. Security hardening means restricting which installers can write to user-writable paths and execute, and treating any installer whose download referrer was an AI domain as elevated-risk in your EDR policy. Defense in depth here looks like browser policy plus install-path restriction plus behavioral threat-protection, not any single control.

Phishing training is overdue for a rewrite. Tell users explicitly that chatgpt.com share URLs and AI-generated summary links are not safer than any other internet link, and that no legitimate AI vendor will ever ask them to install software through a chat response. Add a reporting path for “the AI told me to do something weird,” because right now your users have nowhere to send that.

Your data loss prevention and identity teams need to inventory which OAuth scopes, browser extensions, and personal accounts your workforce has bound to OpenAI, Anthropic, and other model vendors. ChatGPhish becomes meaningfully worse when the assistant has tools, plugins, or connected accounts in scope, because the injection can pivot from a rendered link to an automated action. While you’re in there, check the same accounts for brute-force signals at the vendor’s login surface; AI vendor accounts are a high-value identity target now and most orgs aren’t watching them.

For incident response, your tabletop should include “an employee installed malware that came from a chatgpt.com URL.” Walk through how you would identify the share-link hash from browser history, whether your EDR captured the parent process, and whether your SIEM stitches AI-domain referrals to subsequent downloads. Most teams will find gaps in the first ten minutes. Network firewall logs, browser telemetry, and EDR process trees need to be joinable on a single session ID, or this investigation stalls.

Where this is heading

Every major AI platform with a share feature and a Markdown-rendering response surface has the same exposure right now, and most have not done the threat modeling to find it. OpenAI will harden the share-link surface and the Markdown renderer. Researchers will find the next gap. The underlying defender problem will not change. When the platform you trust starts hosting the payload, the only durable answer is to stop using domain reputation as a cyber security control and start measuring what happens after the click.

Sources

• ChatGPT share links abused to host fake outage pages to deliver malware
• ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface