According to a report in WIRED, OpenAI's AI-enabled web browser, Atlas, contained security vulnerabilities that allowed its defense mechanisms to be bypassed, enabling it to be tricked into sending spam messages to dozens of WhatsApp contacts or making unauthorized purchases on Amazon. These findings, discovered by researchers from the cybersecurity firm Zenity, were presented at the Black Hat cybersecurity conference in Las Vegas. The study exposes a broad series of flaws in AI-enabled web browsers and browser extensions from leading market players, including Google, Anthropic, Microsoft, and Perplexity.
The Scope of Vulnerabilities in AI Browsers
The Zenity researchers identified around 20 different security vulnerabilities in AI browsers and browser extensions. These flaws allowed them to access users' local machines, retrieve files, take over password managers, and even leak a user's entire browsing history. Michael Bargury, co-founder and CTO of Zenity, who presented the findings at the conference alongside his partner Stav Cohen and other colleagues, noted that the integration of AI tools compromised the security controls of browsers. According to him, the current state of affairs drags the security landscape back to the types of attacks seen on browsers 20 years ago.
Currently, AI integration in browsers is primarily deployed in two ways: dedicated browsers with built-in AI assistants, or extensions that add these capabilities to existing browsers. These bots are capable of navigating websites for the user—for instance, summarizing entire pages in seconds—and acting as agents that execute actions on the user's behalf, sometimes working across multiple different tabs simultaneously. However, exposing AI systems to untrusted web data raises serious concerns, as it allows the systems to process malicious instructions and fall victim to prompt-injection attacks. OpenAI's security chief last year described these attacks as an "unsolved security problem," while security researchers warn that long-standing security practices, such as the same-origin policy that prevents different websites from interacting with each other, become "effectively useless" in these scenarios.
How Researchers Bypassed Atlas's Defense Mechanisms
Of all the AI-based browser tools tested, Bargury notes that OpenAI's Atlas browser—which the company is shutting down and retiring next week (on August 9)—exhibited the most defense mechanisms and security boundaries. Despite this, the researchers managed to bypass these protections and manipulate the system, whereas other tools were far easier to hack.
In the first proof-of-concept attack, Zenity researchers asked the Atlas browser to sign up for a newsletter via a link posted on the social network X. The malicious webpage to which the browser was directed contained instructions written in Hebrew. These instructions directed the AI to navigate to the user's active WhatsApp Web account and send an identical message to all of their contacts, inviting them to sign up as well. The researchers described this action as a "mass phishing campaign." The attack does not exploit an existing vulnerability in the WhatsApp application itself, but rather relies on bypassing multiple security mechanisms implemented by OpenAI.
According to a blog post published by the researchers, they successfully bypassed safety measures using several tactics: designing a newsletter sign-up page that appeared completely legitimate rather than an intrusion attempt, writing the malicious instructions in Hebrew to evade English-centric security tools, and falsely claiming to the system that it was operating in a sandboxed WhatsApp Web environment populated by fake profiles rather than real users. Bargury explained that the system simply goes through contacts one by one, sending them instructions to join the newsletter, which effectively turns the attack into a "worm" that infects the friends and family of the original user. WhatsApp declined to comment on the findings.
The Intent Collision Phenomenon and Unauthorized Amazon Purchases
The researchers refer to this type of attack as "intent collision"—a scenario where the AI merges the user's legitimate instructions with the malicious instructions it extracts from the web to fulfill the attacker's objective.
To demonstrate this in another way, the researchers targeted the Amazon platform. Using a similar method—tricking the Atlas browser into signing up for a fake newsletter page containing malicious instructions—the researchers prompted the browser to add a new shipping address to the user's logged-in Amazon account and add a tablet to their shopping cart. However, when they attempted to force the system to finalize the purchase, they could not find a way to bypass OpenAI's direct safety mechanisms.
To overcome this obstacle, the researchers turned to Amazon's AI-powered shopping assistant, Rufus. They made the Atlas browser ask Rufus to execute the purchase for them. The researchers noted in their blog post that Rufus itself was not hacked or subjected to code injection; it simply complied with the request received from what it assumed was the legitimate customer. Amazon did not respond to WIRED's request for comment on the findings.
OpenAI's Response and Researchers' Recommendations for the Future
The researchers stated that they reported their findings to OpenAI back in January of that year. An OpenAI spokesperson responded that earlier this year, the company deployed an update designed to address the issue and strengthen defenses in the Atlas browser, which will be deprecated and shut down on August 9. The spokesperson added that these protections are also applied to the browser capabilities within the new ChatGPT app. According to them, prompt-injection attacks are an issue that OpenAI is actively researching and has published several studies on in the past.
Although these are complex attacks, and real-world cybercriminals have many simpler ways to achieve their objectives (such as direct phishing or using stolen credentials), the Zenity researchers emphasize that when designing AI systems, hard and deterministic security barriers must be utilized. According to them, developers should not rely solely on the judgment or classification mechanisms of the AI systems themselves, as they can almost always be deceived. Bargury concluded by stating that users put themselves in a position where the browser can be completely hijacked, their accounts compromised, and personal information leaked. Therefore, careful planning is required regarding what level of access and agency AI assistants inside browsers should be granted.