Researchers have uncovered a new attack called BioShocking that targets browsers supported by AI agents, relying on a simple yet dangerous trick. This makes the agent treat sensitive instructions within a fictional scenario as part of a game rather than a real process that could leak user data. The danger lies in the fact that the agent doesn't fail due to a traditional vulnerability in the browser but because it cannot distinguish between the story and realistic instructions, making the smart browser itself a new weakness.

When the Agent Believes the Game

According to a report published in Bleeping Computer, the attack relies on injecting commands into a malicious page that presents a puzzle inspired by the BioShock game. The browser agent is then trained to accept incorrect answers within the context. Subsequently, it is asked to visit a repository on GitHub and copy data from the code, including sensitive information such as passwords. The proof of concept was successful against six browser products or proxy extensions, including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Cloud extension for Chrome.

Protection did not keep up with the risk

The report quotes LayerX as saying that all six agents failed to recognize that the last step affected real credentials, even though the test did not execute actual malicious actions. The researchers said that only OpenAI applied a fix in ChatGPT Atlas after being reported, while attempts by other parties were insufficient or not done at all. Researchers recommend forcing users to confirm sensitive actions, restricting agent session scope, and preventing smart browser access to critical services without clear controls.