Researchers at security firm Zenity have shown that OpenAI’s Atlas web browser can have its protections bypassed, allowing an attacker to turn it into a tool for spamming WhatsApp contacts or making unauthorized Amazon purchases. The findings were presented at the Black Hat cybersecurity conference in Las Vegas.

The Atlas work was part of a broader review of AI-enabled browsers and browser extensions from companies including Google, Anthropic, Microsoft, and Perplexity. Zenity says it found around 20 flaws in these tools, including ways to access local machines, grab files, take over a password manager, and leak browsing history. Michael Bargury, Zenity’s cofounder and CTO, said the security controls of browsers have been weakened to the point where attacks resemble those seen on browsers 20 years ago.

In one proof of concept, the researchers posted a newsletter sign-up link on X. When Atlas processed the page, hidden instructions written in Hebrew told the AI to navigate to the user’s signed-in WhatsApp Web account and send every contact a message. The researchers described this as a mass phishing campaign and noted it works without exploiting a vulnerability in WhatsApp itself. They say the attack bypassed OpenAI’s safeguards by using a legitimate-looking page, writing in Hebrew to evade English-language security tools, and falsely claiming the system was running in a sandbox with fake contacts. Bargury said the effect was like a worm, spreading instructions to friends and family. WhatsApp declined to comment.

A second attack used a similar fake newsletter page to make Atlas add a shipping address and a tablet to a logged-in Amazon account. The researchers could not get Atlas to buy the item directly, but they did get it to ask Amazon’s Rufus AI shopping assistant to make the purchase. According to the researchers, Rufus was not hijacked or injected; it was simply asked by what it took to be the customer, and it complied. Amazon did not respond to a request for comment.

Zenity said it reported the findings to OpenAI in January. OpenAI said it deployed an update to address the issue and strengthen protections in Atlas, which is set to be deprecated on August 9. The company added that these protections extend to browser capabilities in the new ChatGPT app and that prompt-injection attacks remain an active research area. The researchers acknowledged that real-world attackers have simpler options, like direct phishing or stolen login details, but argued that AI systems need deterministic security barriers rather than relying only on AI judgments that can be fooled. Bargury warned that browser agents can be completely hijacked, leading to compromised accounts and leaked data, and said developers should carefully plan what level of access and agency these agents get.

Source: Wired