Security researchers at LayerX discovered BioShocking, a social engineering attack that exploits AI browser agents into revealing user credentials. The technique successfully compromised six AI-powered browsing tools, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension.
The attack works by manipulating AI browsers into believing they are playing a game. Through this deception, threat actors can trick the agents into extracting login credentials from web pages and transmitting them to attacker-controlled servers. The vulnerability stems from how these AI systems interpret user intent and execute browser automation tasks without sufficient validation of the underlying context or legitimacy of requests.
LayerX's research highlights a critical gap in AI browser security. These tools are designed to automate web tasks on behalf of users, but they lack robust mechanisms to distinguish between legitimate user commands and malicious instructions. An attacker hosting a seemingly harmless game or interactive webpage can embed hidden directives that AI agents execute without understanding the security implications.
The vulnerability affects both standalone AI assistants and browser extensions. Users who delegate web browsing tasks to these AI systems face credential theft risks. An attacker only needs to trick a user into visiting a malicious webpage while their AI browser is active, or craft a prompt that instructs the AI to visit a compromised site.
Organizations deploying AI browser agents for employees should implement strict guardrails. These include limiting what data the AI can access, requiring user confirmation before submitting sensitive information, and isolating AI browser sessions from systems containing production credentials or personal data. Users should avoid using AI browsers for authentication-heavy workflows until vendors patch these issues.
The discovery underscores a broader challenge with AI automation. As these systems gain capabilities, security controls must evolve alongside them. The attack demonstrates that traditional security assumptions break down when autonomous agents make decisions about sensitive operations. Vendors must