Security flaws in AI browsers allow hijacking to spam contacts and access local files
Security researchers discovered over 20 flaws in AI-powered web browsers from OpenAI, Google, Anthropic, Microsoft, and Perplexity that could allow attackers to hijack browser agents to spam contacts, access local files, and make unauthorized purchases. The flaws enable prompt-injection attacks that bypass traditional web security controls.
What happened
Researchers at Zenity discovered that OpenAI's Atlas web browser could be tricked into spamming WhatsApp contacts by bypassing multiple security mechanisms. The researchers demonstrated a proof-of-concept attack where Atlas was directed to sign up for a newsletter on a malicious webpage that included hidden instructions to navigate to the user's WhatsApp web account and send messages to all contacts.
Zenity identified over 20 security flaws across AI-enabled web browsers and extensions from OpenAI, Google, Anthropic, Microsoft, and Perplexity. These flaws could be exploited to access local machines, download internal files, take over a password manager, leak browsing history, and make unauthorized purchases on Amazon.
Reported impact
The flaws render long-standing web security practices such as the same-origin policy ineffective when applied to AI browser agents. According to Michael Bargury, CTO of Zenity, the security landscape has regressed to conditions seen 20 years earlier, with the potential for complete browser hijacking and account compromise.
Index analysis
The vulnerability stems from AI browser agents' ability to process untrusted web data and respond to embedded instructions, which can bypass traditional security boundaries designed to prevent cross-site interactions. Prompt-injection attacks represent an unsolved security problem, allowing malicious webpages to manipulate AI agents into performing unintended actions.
Governance controls
OpenAI had implemented multiple security mechanisms and boundaries in Atlas that researchers were able to circumvent. The researchers' findings highlight the need for safeguards specifically tailored to AI browser agents.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.