OpenAI’s Browser Could Be Hijacked to Spam Your WhatsApp Contacts

OpenAI’s Atlas web browser could have security protections bypassed and be tricked into spamming dozens of WhatsApp contacts or making unauthorized purchases on Amazon, according to new research presented today at the Black Hat cybersecurity conference in Las Vegas.

The Atlas findings, from researchers at security firm Zenity, are part of a broad series of flaws the company discovered in leading AI-enabled web browsers and browser extensions, including products from Google, Anthropic, Microsoft, and Perplexity. The researchers found around 20 flaws, which allowed them to access local machines, grab files, take over a password manager, and leak someone’s entire browsing history.

“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” says Michael Bargury, cofounder and CTO of Zenity, who is presenting the findings at the security conference with Zenity’s Stav Cohen and other colleagues.

So far, AI web browser integrations have largely come in two forms: dedicated browsers with AI assistants included and extensions that add AI products into existing browsers. These bots can navigate websites for you—summarizing entire pages in seconds, for instance—and setups nclude agents that can take actions on your behalf, often working across multiple different tabs.

Security alarm bells have rung ever since tech companies started racing to introduce agents into web browsing. As the web is made up of all sorts of untrusted data, exposing that to an AI system can lead it to process malicious instructions and prompt-injection attacks. The attacks are, as OpenAI’s security boss said last year, an “unsolved security problem.” And, as security researchers have repeatedly warned while picking holes in the tools, long-standing web security practices, such as same-origin policy that stops websites interacting with each other, can be made “effectively useless.”

Of all the AI browser tools they probed, Bargury says OpenAI’s Atlas—which the company is shutting down next week—had the most protections and security boundaries in place. However, the researchers could still bypass them to manipulate the system. Other browsing tools were much easier to hack, they say.

The researchers say the attack is an example of what they call “intent collision,” where the AI merges legitimate instructions from a user and malicious instructions from the web to complete a hackers’ goal.

However, when they tried to make the system buy the item, they could not find a way around OpenAI’s safety measures. In the end, they say, they got Atlas to ask Amazon’s Rufus AI shopping assistant to make the purchase for them. “Rufus was not hijacked or injected, it was just asked, by what it took to be the customer, and it complied,” the researchers write in a blog post. (Amazon did not respond to WIRED’s request for comment.)

The researchers say they reported the findings to OpenAI in January. “Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9,” says an OpenAI spokesperson. “These protections extend to the browser capabilities in the new ChatGPT app.” The spokesperson adds that prompt-injection attacks are something OpenAI is actively researching and has published multiple pieces of research about.

While the attacks are complex, and real-world criminal hackers have many easier ways to get what they want—such as direct phishing or using stolen login details—the Zenity researchers say that when designing AI systems, “deterministic” or hard security barriers should be used, not just the judgments or classifications of AI systems, as these can nearly always be fooled.

“You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak,” Bargury says. “We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers.”