RESOLVING THE LEDGER
This is one outlet's own report from Wired — the article as it was filed. Other outlets are covering the same event; open the full story to compare every source side by side.
See the full story · 1 sources
The Atlas findings, from researchers at security firm Zenity, are part of a broad series of flaws the company discovered in leading AI-enabled web browsers and browser extensions, including products from Google, Anthropic, Microsoft, and Perplexity. The researchers found around 20 flaws, which allowed them to access local machines, grab files, take over a password manager, and leak someone’s entire browsing history.
“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” says Michael Bargury, cofounder and CTO of Zenity, who is presenting the findings at the security conference with Zenity’s Stav Cohen and other colleagues.
So far, AI web browser integrations have largely come in two forms: dedicated browsers with AI assistants included and extensions that add AI products into existing browsers. These bots can navigate websites for you—summarizing entire pages in seconds, for instance—and setups nclude agents that can take actions on your behalf, often working across multiple different tabs.
Security alarm bells have rung ever since tech companies started racing to introduce agents into web browsing. As the web is made up of all sorts of untrusted data, exposing that to an AI system can lead it to process malicious instructions and prompt-injection attacks. The attacks are, as OpenAI’s security boss said last year, an “unsolved security problem.” And, as security researchers have repeatedly warned while picking holes in the tools, long-standing web security practices, such as same-origin policy that stops websites interacting with each other, can be made “effectively useless.”
Of all the AI browser tools they probed, Bargury says OpenAI’s Atlas—which the company is shutting down next week—had the most protections and security boundaries in place. However, the researchers could still bypass them to manipulate the system. Other browsing tools were much easier to hack, they say.
“What it’ll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm,” Bargury says. “So you are now infecting the rest of your friends and family.” (WhatsApp declined to comment on the findings.)
The researchers say the attack is an example of what they call “intent collision,” where the AI merges legitimate instructions from a user and malicious instructions from the web to complete a hackers’ goal.
However, when they tried to make the system buy the item, they could not find a way around OpenAI’s safety measures. In the end, they say, they got Atlas to ask Amazon’s Rufus AI shopping assistant to make the purchase for them. “Rufus was not hijacked or injected, it was just asked, by what it took to be the customer, and it complied,” the researchers write in a blog post. (Amazon did not respond to WIRED’s request for comment.)
The researchers say they reported the findings to OpenAI in January. “Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9,” says an OpenAI spokesperson. “These protections extend to the browser capabilities in the new ChatGPT app.” The spokesperson adds that prompt-injection attacks are something OpenAI is actively researching and has published multiple pieces of research about.
“You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak,” Bargury says. “We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers.”
AIPROPX is an independent multi-source news index — we track, compare, and connect coverage from across the web into one place you won't find anywhere else.