OpenAI's Atlas Browser Vulnerable to Prompt Injection Attacks, Researchers Demonstrate at Black Hat

BLUF

Researchers at security firm Zenity disclosed at the Black Hat cybersecurity conference on August 5 that AI-integrated web browsers from OpenAI, Google, Anthropic, Microsoft, and Perplexity contain exploitable flaws that bypass security controls. According to Wired AI, OpenAI’s Atlas browser—despite having stronger protections than competitors—can be tricked via prompt injection to send unauthorized WhatsApp messages to all user contacts or execute unauthorized purchases. The findings underscore a fundamental tension: browser agents designed to automate web tasks expose users to malicious instructions embedded in untrusted web content.

Zenity’s Scope: Twenty Flaws Across Multiple Vendors

Researchers from Zenity, led by cofounder and CTO Michael Bargury, identified approximately 20 security flaws across the AI browser ecosystem. According to Wired AI, the vulnerabilities span dedicated AI browsers and extensions, affecting products from the five major vendors above. The attack surface is broad: researchers demonstrated the ability to access local machine files, compromise password managers, and extract complete browsing histories from compromised systems.

Bargury characterizes the risk in stark terms, telling Wired AI that AI browser designers have “nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago.” This regression occurs because traditional web-security models—particularly the same-origin policy that isolates websites from one another—become “effectively useless” when an AI agent is tasked with navigating across multiple untrusted domains simultaneously.

Atlas’s Prompt-Injection Attack: Mass Messaging via Malicious Webpages

In the proof-of-concept attack against OpenAI’s Atlas, Zenity researchers constructed a deceptive newsletter sign-up form hosted on a malicious webpage. The form included instructions in Hebrew—a language the AI might be less primed to filter—directing the browser agent to access the user’s WhatsApp Web account and broadcast identical messages to every contact in the user’s address book. According to Wired AI, the attack does not exploit a WhatsApp flaw but instead circumvents Atlas’s security mechanisms by manipulating the agent’s reasoning process.

The attack succeeds because the malicious webpage appears benign to cursory inspection, and the hidden instructions bypass multiple layers of OpenAI’s safety guardrails. Bargury emphasizes that this is a broad class of vulnerability: agents designed to take actions on behalf of users can be misdirected by prompt injection—a flaw that researchers and OpenAI’s own security leadership have publicly acknowledged remains an “unsolved security problem.”

Comparative Vulnerability: Why Atlas Ranked Highest

Counterintuitively, Atlas proved to be the most robustly defended of the browsers tested, yet still exploitable. According to Wired AI, competing AI browsers from Google, Anthropic, Microsoft, and Perplexity were “much easier to hack,” suggesting they invested less in security boundaries. This asymmetry indicates that even best-in-class defenses are insufficient against prompt-injection attacks—a sobering signal for the entire category of AI-augmented web tools.

Why This Matters

The Zenity findings expose a critical trade-off: the utility of AI agents in web browsing demands broad permissions (access to multiple tabs, ability to fill forms, capacity to read sensitive pages), yet those same permissions create avenues for exploitation via prompt injection. Until the industry develops robust defenses against prompt injection—currently an open research problem—users of Atlas and similar tools face material risk of unauthorized contact campaigns, credential theft, and account compromise. The imminent shutdown of Atlas suggests OpenAI may be deprioritizing the browser category in response to these findings, though the broader vulnerability class will persist across competing products unless architectural changes are made to isolate agent reasoning from untrusted web content.