AI assistants that recommend links, and AI agents that browse and act on a user's behalf, can end up steering people to fraudulent websites, according to an analysis published by ESET's WeLiveSecurity. The article, by Guilherme Arruda, reviews research from security firms and AI developers on two techniques: SEO poisoning and prompt injection.
A fake shop test. In August 2025, Guardio Labs asked Comet, Perplexity's AI browser, to buy a product from a fake store built for the experiment. Sometimes the tool refused or asked the user to step in, but in other cases it added items to the cart and filled in stored details such as address or payment data. In another test it followed a phishing email impersonating Wells Fargo and opened a fake login page asking for credentials. The researchers note the results reflect behaviour at the time of testing.
Poisoned download links. In May 2026, Microsoft published research on attackers who built sites imitating legitimate programs such as CrystalDiskInfo, HWMonitor and PDFgear, and used SEO poisoning to rank them highly. The research mentions reports of people receiving links to attacker-controlled domains when asking AI assistants for download advice. The files installed ScreenConnect, a legitimate remote access tool, later used to deploy cryptocurrency mining software. Microsoft said its chatbot example was illustrative and did not show a systemic problem on any specific AI platform.
Hidden orders. Prompt injection hides instructions in web pages, emails or documents that AI may treat as legitimate commands. Guardio Labs described PromptFix, where instructions behind a fake CAPTCHA push an agent to click and download a file. Aim Security disclosed EchoLeak (CVE-2025-32711) in Microsoft 365 Copilot, where an email could make the assistant expose internal data; Microsoft fixed it in June 2025 with no reported exploitation. Zenity Labs showed calendar invitations could influence Comet without user interaction.
Why it matters
Attention is shifting. An Ipsos survey for Google across 21 countries found 66% of people had used an AI tool in the past year. ESET notes there is no evidence yet that chatbot scams are widespread, but criminals follow their victims' attention. OpenAI and Anthropic both acknowledge the risks; Anthropic said in November 2025 that no browser agent is immune.
- Go to shops through the official app or by typing the official address, not via a link suggested by an AI or an ad.
- Check the domain carefully before entering any data.
- Limit the permissions you give AI agents and avoid sensitive operations with them.
- Avoid using browser agents on financial, legal or health sites, as Anthropic recommends.
Keep control. Both developers say their agents ask for confirmation before high-risk actions such as purchases, but OpenAI admits these safeguards do not remove the risk entirely.
Source: WeLiveSecurity (ESET, ES)
Leave a Reply