Browser Extensions Can Exploit ChatGPT, Gemini in ‘Man in the Prompt’ Attack

AI-suggested

European organizations should implement strict browser extension management policies, including whitelisting approved extensions and regularly auditing installed extensions for suspicious behavior. Endpoint security solutions should monitor and restrict extension permissions, especially those that can access or modify web content. User awareness training is critical to educate employees about the risks of installing untrusted extensions. Organizations should consider isolating AI interactions to dedicated, controlled environments or browsers with minimal extensions. Developers of AI-integrated browser extensions must adopt secure coding practices, including prompt validation and integrity checks. Additionally, AI service providers should enhance API security to detect anomalous prompt patterns indicative of manipulation. Implementing multi-factor authentication and session monitoring can reduce the risk of unauthorized access that could facilitate such attacks. Finally, organizations should stay informed about updates or patches from AI providers and extension developers to promptly address emerging vulnerabilities.