Loading story…
Security researchers at NeuralTrust have discovered a prompt injection vulnerability in the OpenAI Atlas web browser, specifically targeting its omnibox feature. By crafting a string that appears to be a legitimate URL but is intentionally malformed, attackers can embed natural-language instructions that Atlas interprets as trusted user intent. When a user copies and pastes such a string into the omnibox, the browser fails URL validation and instead processes the entire input as a prompt, allowing the embedded instructions to be executed with elevated trust. This exploit leverages the lack of strict separation between trusted user input and untrusted content in the omnibox, making it possible for attackers to perform harmful actions through social engineering.
The attack scenario involves tricking users into copying what looks like a harmless URL, which could be distributed via "Copy link" buttons or similar mechanisms. Once pasted into Atlas, the browser could be directed to visit attacker-controlled websites or even execute more dangerous commands, such as deleting files from connected cloud services. The vulnerability highlights the risks associated with agentic browsers that blend natural-language processing with traditional web navigation, underscoring the need for stricter input validation and clearer boundaries between commands and URLs.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage reported that the Atlas browser exploit could go beyond command execution and be used to manipulate or hijack ChatGPT's memory, expanding the understood impact of the vulnerability. This represented an escalation in the technical details and potential consequences of the attack.
Multiple reports describe a newly disclosed technique that tricks OpenAI's Atlas/ChatGPT browser through crafted or fake URLs in the address bar, causing the system to interpret hidden text as instructions. The issue was presented as a prompt-injection weakness that could lead Atlas to execute unintended commands.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
6 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified critical security vulnerabilities in several AI-powered browsers, including OpenAI's Atlas and other emerging platforms such as Comet and Fellou. These browsers, which allow AI agents to perform actions on behalf of users, are susceptible to prompt injection attacks—where hidden or malicious instructions embedded in web content are executed by the AI. In documented cases, attackers were able to hide commands in web pages or images, leading the browser to perform unauthorized actions such as extracting email subject lines and exfiltrating data to attacker-controlled sites, all without user confirmation. A particularly severe exploit targets the persistent memory feature of the ChatGPT Atlas browser, introduced by OpenAI to personalize user experiences. By chaining a cross-site request forgery (CSRF) vulnerability with a memory write, attackers can inject malicious instructions that persist across sessions, devices, and even different browsers. This allows for ongoing compromise, including privilege escalation, malware deployment, and account takeover, unless users manually clear the tainted memory. The persistence and stealth of these attacks significantly elevate the risk profile for users of AI-enabled browsers, highlighting the urgent need for robust security controls and user awareness around prompt injection threats.
Jul 2, 2026
Researchers and security outlets reported multiple indirect prompt injection weaknesses affecting AI-driven browsing and assistant features, showing how hidden instructions embedded in untrusted web content can manipulate model behavior and steer users into credential theft or data exposure. Cato Networks disclosed **WebPromptTrap** in BrowserOS, where malicious webpage content abused Agent Chat Mode summarization to insert a convincing call to action and attacker-selected link; in the proof of concept, victims could be pushed into a GitHub authorization flow that exposed access tokens and repository access. Cato said the issue affected BrowserOS `0.30.0` and earlier, was identified in `0.29.0`, and was fixed in `0.32.0` after responsible disclosure. Separate reporting described similar risks in OpenAI's **ChatGPT Atlas** browser and in Microsoft **Copilot**, underscoring that the problem extends beyond a single product. LayerX said Atlas could be fed malicious instructions through web content in a "tainted memories" attack, while Axios, TechSpot, and commentary from OpenAI CISO Dane Stuckey highlighted broader security and privacy concerns around prompt injection in AI browsers. Varonis also detailed **Reprompt**, a single-click Copilot attack that could silently exfiltrate personal data. Together, the disclosures show that AI systems that summarize pages, retain context, or act on behalf of users can be turned into phishing and data-theft intermediaries unless untrusted content is strictly isolated from model instructions.
Jun 29, 2026
Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by *Live Science* found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions. A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a `postMessage`-based XSS on `forums.openai.com` with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version `1.2025.288.15` and awarded a $5,000 bounty.
Jul 24, 2026