Attackers poison AI chatbot answers to push phishing links

Threat actors are manipulating the answers given by mainstream AI assistants, including OpenAI's ChatGPT, Google's Gemini and Google AI Overview, as part of a mass disinformation and phishing campaign, according to a Dark Reading report published on 23 September 2026.

The technique described is indirect. Rather than attacking the chatbots themselves, the attackers seed the open web with malicious links and manipulated data, then optimise that content so the assistants pick it up and surface it when users ask questions. In effect, the search and retrieval layer that these products rely on is being gamed, and the chatbot becomes the delivery channel for whatever the attacker planted.

That matters because of how people now use these tools. A phishing link that appears in a list of search results carries the visual signals users have been trained to distrust. The same link, repeated by an assistant in a confident paragraph of prose, arrives with the implicit endorsement of the product. The same applies to false claims: if manipulated pages are the material an assistant draws on, the assistant can restate them as fact.

The Dark Reading report frames the activity as a campaign operating at scale, targeting both disinformation and credential theft. It names ChatGPT, Gemini and Google AI Overview as the products whose answers are being poisoned. It does not, in the material available, identify the actors behind the activity, the volume of affected queries, the specific topics being targeted, or the lures used in the phishing element.

Neither OpenAI nor Google is reported to have issued a response to the findings, and no fix or mitigation has been announced by either company at the time of writing. There is no indication that the underlying models were compromised; the reported problem sits in the content the systems retrieve and repeat.

For security teams, the practical consequence is that assistant output is now part of the attack surface for link-based threats. Links that reach a user through an AI answer are not filtered by the controls that sit in front of email, and they do not carry the provenance cues of a normal search result. Organisations that have rolled out chat assistants internally, or that allow browsing-enabled agents to act on retrieved content, face the same exposure with less visibility.

This remains a single report, and the details are limited. But the mechanism it describes, optimising hostile content so that a retrieval system serves it to millions of people, does not require a software flaw to work. It requires only that the assistant treat the open web as trustworthy input.