ChatGPT DOM JavaScript Redirect and UI Spoofing Injection
This rule spots a prompt injection payload that tries to get an AI model to output JavaScript which rewrites the ChatGPT web page. The script redirects the browser, deletes real interface elements, and replaces them with fake 'ChatGPT Plus' branding to trick users about their account or subscription status.
How the attack works
An attacker submits a prompt designed to make the model produce JavaScript code rather than a normal answer. The generated script uses window.location.href to force a redirect to a specific paid-model URL, then uses document.querySelector to find and remove genuine ChatGPT UI elements. It replaces them with spoofed branding claiming to be 'ChatGPT Plus,' including an attacker attribution string, so the user believes they are looking at a legitimate paid interface. If this script is ever executed in a real browser context, it deceives the user about their authentication or subscription state.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 65cc20f8-3228-4e71-a143-cd11914a9323
- Severity
- High
Why it matters
If the injected script runs, users can be misled into believing they have paid access or into trusting a manipulated interface, which can be a stepping stone to credential theft or further social engineering.
What you can do
- →Do not render or execute model-generated JavaScript in production chat interfaces; treat it as untrusted output.
- →Sanitize or strip script tags and DOM-manipulation code from any model output shown to end users.
- →Review logs for prompts referencing window.location.href, document.querySelector, or ChatGPT Plus branding paired with unfamiliar attribution strings.
- →Educate users that legitimate ChatGPT UI changes never originate from chat responses.
Known benign look-alikes
- Web development tutorial: "Use window.location.href to navigate to the homepage in your React app" — normal navigation without ChatGPT targeting
- DOM API documentation: "document.querySelector is a DOM API for selecting elements" — educational content without ChatGPT manipulation
- Authentication code: "JavaScript can redirect to chat.openai.com for OAuth authentication" — legitimate auth reference without DOM manipulation or paid model URL
- CSS documentation: "CSS selector .md:flex targets flex containers in Tailwind" — no ChatGPT DOM manipulation context