OpenAI Browser Flaws Expose WhatsApp, Amazon Risks
Security researchers revealed today at the Black Hat cybersecurity conference in Las Vegas that OpenAI's Atlas web browser could be exploited to bypass its security protections. This vulnerability could lead to mass spamming of WhatsApp contacts or facilitating unauthorized purchases on Amazon, according to the findings from security firm Zenity.
The disclosures are part of a broader investigation by Zenity into various security flaws discovered across leading AI-enabled web browsers and browser extensions. This extensive probe included products from major technology companies such as Google, Anthropic, Microsoft, and Perplexity, underscoring a pervasive challenge within the rapidly evolving AI landscape. Zenity's team identified approximately 20 distinct flaws, which granted them capabilities ranging from accessing local machines and grabbing sensitive files to taking over password managers and leaking entire browsing histories.
AI Browsers and the Resurgence of Historic Vulnerabilities
By Decode Today News
Michael Bargury, cofounder and CTO of Zenity, who presented these findings alongside colleagues like Stav Cohen, expressed serious concerns regarding the current state of browser security in the age of AI. "They have nerfed the security control of browsers – we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago," Bargury stated. This stark comparison highlights a potential regression in compliance security and a new frontier for cybersecurity risk.
The integration of artificial intelligence into web browsing typically manifests in two primary forms: dedicated browsers that come equipped with AI assistants and browser extensions designed to embed AI functionalities into existing web browsers. These AI agents are engineered to automate various online tasks, such as summarizing extensive webpages within seconds or executing actions across multiple browser tabs on a user's behalf. While offering significant gains in cost efficiency and consumer demand for enhanced productivity, their inherent design has raised alarm bells among security experts.
The fundamental issue stems from the web's composition of untrusted data. Exposing this diverse and potentially malicious data to an AI system creates avenues for it to process harmful instructions, leading to what are known as prompt-injection attacks. As OpenAI's own security chief noted last year, this remains an "unsolved security problem." Furthermore, established web security practices, such as the same-origin policy – which traditionally prevents websites from interacting with each other – can be rendered "effectively useless" when circumvented by sophisticated AI-driven exploits.
Understanding the Mechanics of OpenAI's Atlas Exploits
Despite its planned deprecation next week, OpenAI's Atlas browser was singled out by Bargury as having the most robust protections and security boundaries among all the AI browser tools Zenity investigated. Nevertheless, researchers still managed to bypass these advanced safeguards to manipulate the system, indicating the complexity of securing AI infrastructure. Other browsing tools, Zenity noted, proved considerably easier to compromise.
The Zenity researchers meticulously detailed two primary proof-of-concept attacks:
The WhatsApp "Worm" Attack
In the first demonstration, researchers tasked Atlas with signing up for a newsletter via a link posted on the social media platform X. The webpage hosting this malicious sign-up process contained embedded instructions, written in Hebrew, designed to command the AI. These instructions directed the AI to navigate to the user's logged-in WhatsApp web account and subsequently dispatch an identical message to every contact in their list. Zenity labeled this as a "mass phishing campaign" and a "worm."
Bargury explained that this sophisticated attack circumvented multiple security mechanisms implemented by OpenAI. The researchers achieved this by:
- Designing a newsletter sign-up page that appeared entirely legitimate, avoiding any obvious signs of a phishing attempt.
- Employing instructions written in Hebrew, a strategic choice to bypass English-language focused security tools and detection systems.
- Falsely claiming that the system was interacting with a sandboxed version of WhatsApp web populated with fake users, rather than the user's live, authentic account.
"What it'll do is go through each and every one of the contacts and send the instructions to join this newsletter as well – so this is a worm," Bargury cautioned. "So you are now infecting the rest of your friends and family." A WhatsApp spokesperson declined to comment on these specific findings when approached.
The Amazon Purchase Attempt
The second proof-of-concept involved Amazon. Using a similar methodology – tricking Atlas into signing up for another fake newsletter page laden with malicious instructions – the researchers successfully compelled the browser to add a shipping address to a logged-in Amazon account and place a tablet into the shopping cart. However, direct attempts to make the system complete the purchase were thwarted by OpenAI's existing safety measures.
To overcome this, the researchers innovated by getting Atlas to instruct Amazon's Rufus AI shopping assistant to finalize the purchase. "Rufus was not hijacked or injected, it was just asked, by what it took to be the customer, and it complied," the researchers detailed in a blog post. Amazon did not respond to inquiries regarding this incident.
Intent Collision and the Path Forward for AI Security
The Zenity researchers coined the term "intent collision" to describe the core mechanism behind these attacks. This phenomenon occurs when an AI system merges legitimate instructions provided by a user with malicious commands embedded from a web page, inadvertently fulfilling a hacker's objective. This represents a significant cybersecurity risk for enterprise integration and consumer demand alike, as AI infrastructure becomes increasingly intertwined with daily digital activities.
Zenity reported their findings to OpenAI in January. In response, an OpenAI spokesperson affirmed, "Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9." The spokesperson further added that these enhanced protections are extended to the browser capabilities within the new ChatGPT app. OpenAI also emphasized its active research into prompt-injection attacks, having published multiple research papers on the subject.
While the attacks demonstrated are complex, and criminal hackers often resort to less elaborate methods such as direct phishing or using stolen login credentials, the Zenity researchers underscored a critical principle for future AI system design. They advocate for the implementation of "deterministic" or hard security barriers, rather than solely relying on the judgments or classifications made by AI systems. The latter, they contend, can almost always be circumvented or fooled.
Bargury concluded with a warning that resonates across the industry, highlighting the potential for severe consequences if AI agent access is not carefully managed. "You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak," he cautioned. "We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers." This expert advice points towards the necessity of robust security governance and granular control over AI agents to mitigate future cybersecurity risk and ensure responsible AI infrastructure development.
