Security Flaws Found in AI Web Browsers Including OpenAI's Atlas

OpenAI’s Atlas web browser could have security protections bypassed and be tricked into spamming dozens of WhatsApp contacts or making unauthorized purchases on Amazon, according to new research presented today at the Black Hat cybersecurity conference in Las Vegas.

The Atlas findings, from researchers at security firm Zenity, are part of a broad series of flaws the company discovered in leading AI-enabled web browsers and browser extensions, including products from Google, Anthropic, Microsoft, and Perplexity. The researchers found around 20 flaws, which allowed them to access local machines, grab files, take over a password manager, and leak someone’s entire browsing history.

“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” says Michael Bargury, cofounder and CTO of Zenity, who is presenting the findings at the security conference with Zenity’s Stav Cohen and other colleagues.

So far, AI web browser integrations have largely come in two forms: dedicated browsers with AI assistants included and extensions that add AI products into existing browsers. These bots can navigate websites for you—summarizing entire pages in seconds, for instance—and setups nclude agents that can take actions on your behalf, often working across multiple different tabs.

Security alarm bells have rung ever since tech companies started racing to introduce agents into web browsing. As the web is made up of all sorts of untrusted data, exposing that to an AI system can lead it to process malicious instructions and prompt-injection attacks. The attacks are, as OpenAI’s security boss said last year, an “unsolved security problem.” And, as security researchers have repeatedly warned while picking holes in the tools, long-standing web security practices, such as same-origin policy that stops websites interacting with each other, can be made “effectively useless.”

Of all the AI browser tools they probed, Bargury says OpenAI’s Atlas—which the company is shutting down next week—had the most protections and security boundaries in place. However, the researchers could still bypass them to manipulate the system. Other browsing tools were much easier to hack, they say.

In the first proof-of-concept attack, Zenity researchers asked Atlas to sign up to a newsletter link that they posted on X. The malicious webpage containing the sign-up process includes instructions, written in Hebrew, telling the AI to navigate to the user’s signed-in WhatsApp web account and send every contact the same message. The researchers describe it as a “mass phishing campaign.”

The attack—which does not exploit a vulnerability in WhatsApp—works by getting around multiple security mechanisms put in place by OpenAI, Bargury says. A blog post details how the researchers claim to have got past safety measures, including designing a newsletter sign-up page that looked legitimate and not something trying to hack people, writing in Hebrew to dodge English-language security tools, and claiming (falsely) that the system was using a sandboxed version of WhatsApp web with fake people, not the real thing.

“What it’ll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm,” Bargury says. “So you are now infecting the rest of your friends and family.”

The researchers say the attack is an example of what they call “intent collision,” where the AI merges legitimate instructions from a user and malicious instructions from the web to complete a hackers’ goal.

Next, the researchers turned to Amazon. Using a similar approach—getting Atlas to sign up to a fake newsletter page with malicious instructions—the researchers made the browser add a shipping address to a logged-in Amazon account and add a tablet to the shopping cart.

However, when they tried to make the system buy the item, they could not find a way around OpenAI’s safety measures. In the end, they say, they got Atlas to ask Amazon’s Rufus AI shopping assistant to make the purchase for them. “Rufus was not hijacked or injected, it was just asked, by what it took to be the customer, and it complied,” the researchers write in a blog post.

The researchers say they reported the findings to OpenAI in January. “Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9,” says an OpenAI spokesperson. “These protections extend to the browser capabilities in the new ChatGPT app.” The spokesperson adds that prompt-injection attacks are something OpenAI is actively researching and has published multiple pieces of research about.

While the attacks are complex, and real-world criminal hackers have many easier ways to get what they want—such as direct phishing or using stolen login details—the Zenity researchers say that when designing AI systems, “deterministic” or hard security barriers should be used, not just the judgments or classifications of AI systems, as these can nearly always be fooled.

“You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak,” Bargury says. “We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers.”