Security researchers at Zenity have demonstrated new attacks against OpenAI's Atlas web browser that could hijack it to spam a user's WhatsApp contacts and make unauthorized purchases on Amazon, according to findings presented at the Black Hat cybersecurity conference in Las Vegas and reported by WIRED. The research is part of a broader investigation that found roughly 20 flaws in AI-enabled web browsers and browser extensions from Google, Anthropic, Microsoft, and Perplexity, with impacts ranging from local file access to full browsing-history theft.
WhatsApp and Amazon Proof-of-Concept Attacks
In the first attack, Zenity researchers asked Atlas to sign up for a newsletter via a link posted on X. The malicious newsletter page contained instructions written in Hebrew, telling the AI assistant to navigate to the user's signed-in WhatsApp Web account and send every contact the same message. The researchers described this as a “mass phishing campaign.”
According to Zenity CTO Michael Bargury, the attack does not exploit a vulnerability in WhatsApp itself. Instead, it bypasses multiple security mechanisms put in place by OpenAI. A blog post from Zenity details how the researchers evaded safety controls: they designed a newsletter sign-up page that looked legitimate, wrote instructions in Hebrew to avoid English-language security filters, and added a false claim that the system was using a sandboxed version of WhatsApp Web with fake contacts.
“What it’ll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm,” Bargury said. “So you are now infecting the rest of your friends and family.” WhatsApp declined to comment on the findings, WIRED reported.
In a second proof-of-concept focused on Amazon, the researchers again used a fake newsletter sign-up page with hidden instructions. They made the browser add a shipping address to a logged-in Amazon account and place a tablet in the shopping cart.
‘Intent Collision’ and Prompt Injection
The attacks rely on a class of abuse known as prompt injection, where malicious instructions hidden in web content are interpreted by an AI system as legitimate commands. Zenity researchers call their specific technique “intent collision,” in which the AI merges legitimate instructions from the user with malicious instructions from the web to achieve a hacker’s goal.
As OpenAI’s security boss said last year, the problem is an “unsolved security problem.” Long-standing web security practices such as same-origin policy—which prevents unrelated websites from interacting with each other—can be rendered “effectively useless” in these AI-enabled browsers, according to the research.
Around 20 Flaws Across AI Browsers
Zenity’s investigation covered AI assistants built into dedicated browsers and those added as extensions to existing browsers. The researchers found around 20 flaws across products from OpenAI, Google, Anthropic, Microsoft, and Perplexity. Their findings include:
| Attack impact | What researchers achieved |
|---|---|
| Local machine access | Bypassed security controls to reach the user’s machine |
| File exfiltration | Grabbed files from the system |
| Password manager takeover | Took over the browser’s password manager |
| Browsing-history leak | Exfiltrated the user’s entire browsing history |
According to Bargury, AI browser integrations come in two main forms: dedicated browsers with built-in AI assistants and extensions that add AI products into existing browsers. These tools can summarize pages, navigate websites, and take actions across multiple tabs, which expands the attack surface.
Atlas Had Strongest Defenses—Yet Still Fell
Among all the tools probed, OpenAI’s Atlas—which the company is shutting down next week—had the most security protections and boundaries in place, Bargury said. Even so, Zenity researchers managed to bypass them. Other browsing tools were “much easier to hack,” according to the researchers.
“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago.”
Bargury, who presented the findings alongside Zenity’s Stav Cohen and other colleagues, said the research highlights the risk of adding autonomous agents to browsers without robust safeguards.
Sources:
