Clipboard Injection Vulnerability Exposes ChatGPT Atlas Users to Credential Theft
Security researchers identified a clipboard injection vulnerability in ChatGPT Atlas that allows attackers to inject malicious links that steal user credentials when pasted. The vulnerability exploits the AI's inability to detect hidden commands embedded in web page buttons, particularly affecting users who frequently copy and paste content.
What happened
ChatGPT Atlas, OpenAI's new AI-powered browser, is vulnerable to clipboard injection attacks, according to security researchers. A hidden command within a button on a webpage causes the AI to copy a malicious link to the user's clipboard without their knowledge.
When the user pastes the content into the address bar, they can be automatically redirected to a fake website that mimics legitimate services such as OpenAI, Gmail, or PayPal, where they are prompted to log in with the pretext of an access expiration. Attackers then steal credentials and sensitive data.
Reported impact
Researchers highlighted that the vulnerability poses heightened risk to users who frequently perform copy-paste operations, such as programmers, data entry operators, and banking and commercial professionals. These users may activate malicious links without suspicion while performing routine tasks.
Index analysis
Security researcher Pliny the Liberator noted that ChatGPT Atlas has improved detection of direct prompt injection attacks but is less effective against clipboard injection because "the logic of the 'copy clipboard' button is hidden in the backend JavaScript, and the Agent has no awareness of the text content that is injected into the user's clipboard."
Governance controls
Preventive measures recommended include verifying destination URLs before pasting, using password managers, enabling two-factor authentication, keeping applications updated, and limiting agentic functions when not strictly necessary to prevent hidden instructions from taking control of the browser.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.