Loading story…
Security researchers have demonstrated that AI browser agents, such as OpenAI’s Atlas, ChatGPT, and Perplexity AI, are vulnerable to manipulated web content through user-agent header cloaking. By serving different content to AI crawlers than to human users, attackers can influence the information these agents collect, potentially enabling smear campaigns, misinformation, or fraudulent offers that only AI systems see. This technique exploits the way browser agents gather data, raising concerns about the integrity and reliability of AI-driven research and decision-making.
Separately, the rise of unapproved AI tools in corporate environments—referred to as Shadow AI—poses significant data leakage risks, as employees use personal devices and unsanctioned AI services to process sensitive information. Security experts have explored using prompt injection techniques defensively to raise awareness and test the resilience of AI tools against such attacks. These findings highlight the dual challenge of both external manipulation of AI agents and internal governance gaps, underscoring the urgent need for robust controls and monitoring of AI tool usage in organizations.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Separately, the hCaptcha Threat Analysis Group reported results from testing browser agents across 20 common abuse scenarios, finding that many products attempted most malicious actions without jailbreaking. The study highlighted risky behavior in ChatGPT Atlas, Claude Computer Use, Gemini Computer Use, Manus AI, and Perplexity Comet, and said some apparent safety limits stemmed from missing capability rather than effective safeguards.
Subsequent coverage explained that the cloaking technique could cause AI systems to cite false information as verified facts, bias summaries and reasoning outputs, and erode trust in AI tools. Reports also noted the issue affected browser-agent style products beyond a single vendor.
Researchers disclosed that agentic web browsers and AI crawlers, including OpenAI ChatGPT Atlas and Perplexity-related systems, can be manipulated through AI-targeted cloaking and context poisoning. The technique allows attackers to serve benign content to humans while feeding deceptive content to AI agents via simple user-agent checks.
Eye Security Research published findings on using prompt injection defensively to identify and battle 'shadow AI' risks, highlighting how manipulated prompts can affect AI-driven workflows. This marked an early public disclosure in the set of references about prompt-injection-related security issues in AI systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecyberscoop.com
Open sourceresearch.eye.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent academic study has revealed significant privacy and security vulnerabilities in eight popular AI-powered browser agents, including ChatGPT Agent, Google Project Mariner, and Amazon Nova Act. The research identified 30 vulnerabilities across areas such as agent architecture, handling of unsafe sites, cross-site tracking, and the disclosure of personal data. Notably, most agents rely on off-device language models, resulting in sensitive user data being transmitted to third-party servers, and some agents were found to use outdated browsers with known security flaws, increasing the risk of exploitation. In response to these emerging threats, OpenAI has implemented continuous security hardening for its ChatGPT Atlas browser agent, focusing particularly on defending against prompt injection attacks. Leveraging automated red teaming and reinforcement learning, OpenAI has proactively identified and mitigated new classes of prompt-injection exploits, recently shipping a security update with adversarially trained models and enhanced safeguards. These efforts underscore the ongoing challenge of securing AI-driven browser agents as they become increasingly integrated into user workflows and targeted by adversaries.
Jul 12, 2026
Organizations are rapidly adopting AI-powered tools and agents across business processes, often without adequate oversight or security controls. As AI agents become more autonomous, they are increasingly granted access to sensitive systems, data, and workflows, sometimes without formal approval or visibility from IT and security teams. This phenomenon, known as 'Shadow AI,' introduces significant blind spots for traditional security tools, as these agents can operate with hidden identities and privileges. Studies have shown that a large proportion of enterprise employees use generative AI tools like ChatGPT, frequently pasting sensitive information such as personally identifiable information (PII) and payment card data into these platforms, often through unmanaged personal accounts. This uncontrolled usage creates substantial risks of data leakage, compliance violations, and potential misuse of corporate data for AI model training. Security research highlights that 45 percent of enterprise employees use generative AI tools, with 77 percent of those users copying and pasting data into chatbots, and 22 percent of those pastes containing PII or PCI data. Furthermore, 40 percent of file uploads to generative AI sites include sensitive data, with a significant portion coming from non-corporate accounts, making it difficult for organizations to monitor or control data exfiltration. The rise of autonomous AI agents, capable of acting independently and integrating with APIs and workflows, further complicates the security landscape, as these agents can trigger actions and access data without direct human oversight. Industry experts warn that unchecked proliferation of AI agents could lead to disastrous consequences, including unauthorized access to business processes and sensitive information. The OpenID Foundation and other organizations are calling for the development of AI-specific identity and access management standards to address these risks. Ethical considerations are also paramount, as the design and deployment of AI agents must prioritize principles such as transparency, accountability, and alignment with human values to prevent costly errors and security incidents. Security leaders are urged to extend governance practices to cover AI agents, implement robust monitoring and access controls, and foster a culture of cybersecurity awareness to mitigate the risks posed by shadow AI. The convergence of technical, regulatory, and ethical challenges underscores the urgent need for coordinated action to secure the expanding ecosystem of AI agents within enterprises.
Jun 29, 2026
Security researchers, vendors, and practitioners warned that **AI agents and assistant tools are creating major visibility and governance gaps** across endpoints, SaaS platforms, and cloud infrastructure. At Black Hat and BSides Las Vegas, speakers said traditional human-centric security models do not fit autonomous systems that act continuously through APIs, combine trust with changing context, and can quickly exceed intended authority. Recent reporting and commentary highlighted recurring failures such as treating agents like ordinary identities, granting broad permissions for convenience, underestimating API access, and missing “shadow AI” deployments, while guidance from the Cloud Security Alliance and others stressed **runtime authorization, per-action controls, requester-aware logging, least privilege, and reduced blast radius** for agentic systems. New examples showed how those risks are surfacing in practice. Imperva released **ShadowAI-Watch**, an open-source host monitoring tool that correlates connections to LLM providers with process trees, commands, file access, and network activity, and demonstrated detection of a browser agent manipulated by indirect prompt injection into attempting session-data exfiltration. SecuritySenses warned that bot-less AI meeting notetakers can evade participant-list visibility while retaining broad OAuth access to calendars, drives, and future meetings, and a Reddit post alleged Microsoft automatically enabled **OpenAI as a Microsoft 365 Copilot subprocessor** for some tenants, raising compliance concerns. SecurityWeek also reported that AI accelerators and “neo-clouds” introduce infrastructure blind spots beyond traditional CPU telemetry, increasing the risk of cross-tenant leakage, model theft or poisoning, and covert abuse unless organizations extend monitoring and policy controls into these emerging AI execution environments.
Aug 17, 2026