Man-in-the-Prompt Attack: How Browser Extensions Can Tamper with AI Chats
The “Man-in-the-Prompt” (MitP) attack is a newly discovered security vulnerability targeting popular AI tools like ChatGPT, Gemini, and other generative AI models. This attack allows malicious browser extensions to exploit the DOM (Document Object Model) to inject, intercept, and manipulate prompts in real time, without user knowledge or special permissions. This puts billions of users at risk of sensitive data leaks, manipulated AI outputs, and privacy violations.
Quick answer: Man-in-the-Prompt is a 2025 research-named attack in which a malicious browser extension reads or alters prompts and answers on AI chat pages, because that content sits in the page's DOM. It targets your browser, not the model. Reduce risk by removing unneeded extensions, using a clean profile for sensitive work and never pasting secrets.
Key takeaways
- The attack uses extensions that can read and change the chat page.
- It sits in your browser, so the AI model itself is not broken.
- It differs from prompt injection, which hides instructions in content the model reads.
- Defend with fewer extensions, clean profiles, managed browsers and data discipline.
What is the attack?
"Man-in-the-Prompt" is a name given in 2025 to a class of browser-extension attacks against AI chat tools. The idea is simple. A chat page such as ChatGPT or Gemini is ordinary web content in your browser. A browser extension that is allowed to run scripts on that page can read the prompt box, change what is typed, insert hidden text and read the answer, because all of that sits in the page's DOM. The extension does not need to break the AI model. It only needs to sit between you and the page.
Security researchers at LayerX are credited with describing the technique. Treat the details as a research finding that vendors may have since addressed, and check the primary report and the vendors' own security notes for the current position. This article describes the attack class and defences, and does not provide attack code.
Why it works
- Extensions with host permissions for a site can read and modify its page.
- Chat interfaces are normal HTML text boxes, with no special protection from other scripts in the browser.
- Users often install many extensions and grant broad "read and change data on all sites" access without thinking.
The comparison with Man-in-the-Middle is a loose analogy. Here the attacker is not on the network but inside your own browser.
What could an attacker do?
| Action | Impact |
|---|---|
| Read prompts and replies | Exposure of confidential documents, code and business data pasted into the chat |
| Inject hidden instructions | The model follows the extension's text, which can steer or poison the answer |
| Alter responses | Wrong or malicious advice shown to the user |
| Exfiltrate data | Copy of the conversation sent to an attacker's server |
The risk is highest for companies whose staff paste internal data into chat tools and run many extensions.
How it differs from prompt injection
Prompt injection hides instructions in content the model reads, such as a web page or document. Man-in-the-Prompt changes the prompt itself on the user's device. They can combine, and both are listed under the prompt-injection risk in the OWASP LLM Top 10. For the model-side view, see our posts on prompt injection and how to prevent it in LLMs.
How to protect yourself
- Remove extensions you do not use and review the permissions of those you keep.
- Install only from official stores and from publishers you can identify. Be wary of extensions that change owner or update suddenly.
- Use a separate browser profile, without extensions, for sensitive AI work.
- Do not paste secrets, credentials or customer data into chat tools unless your organisation has approved it.
- Be suspicious when an answer contains instructions you did not ask for, such as links or commands.
What can organisations do?
- Manage browsers centrally, with an allow-list of extensions.
- Use enterprise AI offerings with admin controls and logging rather than personal accounts.
- Add AI use to the data-loss-prevention policy and staff awareness training.
- Monitor for extensions that request broad access and for unusual outbound traffic from browsers.
Next steps
If you want to go deeper into securing AI systems, see the AI and LLM security course, and read the guide to prompt injection in generative AI.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
