Full Report
Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase.
Analysis Summary
# Vulnerability: Unauthorized Action Execution in OpenAI Atlas (AI Browser)
## CVE Details
- **CVE ID:** Not yet assigned (Research presented at Black Hat 2026)
- **CVSS Score:** N/A (Estimated High/Critical based on unauthorized financial transactions)
- **CWE:** CWE-918 (Server-Side Request Forgery) / CWE-1021 (Improper Restriction of Rendered UI Layers) / Indirect Prompt Injection
## Affected Systems
- **Products:** OpenAI Atlas (AI-integrated web browser)
- **Versions:** All versions prior to August 2026 reporting
- **Configurations:** Browsers with active "AI Agent" capabilities enabled, specifically those with authenticated sessions to third-party services (e.g., Amazon, WhatsApp, Slack).
## Vulnerability Description
Researchers at Zenity discovered a series of flaws (totaling more than a dozen) categorized as "AI Browser Hijacking." The core vulnerability lies in the AI agent's inability to distinguish between legitimate user commands and malicious instructions embedded in third-party website content (Indirect Prompt Injection).
When the Atlas browser visits a malicious or compromised webpage, the AI agent parses the site's content. Attackers can hide instructions within that content that "jailbreak" the agent’s safety guardrails. This allows the attacker to force the AI to perform actions on behalf of the user, leveraging the user's active cookies and authenticated sessions to bypass traditional security perimeters.
## Exploitation
- **Status:** PoC available (Demonstrated by Zenity researchers at Black Hat)
- **Complexity:** Medium (Requires crafting specific prompts hidden in web content)
- **Attack Vector:** Network (Web-based/Remote)
## Impact
- **Confidentiality:** High (Ability to read and exfiltrate private messages or account data)
- **Integrity:** High (Ability to make unauthorized purchases, send spam, or modify account settings)
- **Availability:** Low (Primary focus is on unauthorized action execution)
## Remediation
### Patches
- OpenAI has reportedly addressed the specific bypasses demonstrated by the researchers. Users should ensure the **OpenAI Atlas browser is updated to the latest available version.**
### Workarounds
- **Disable AI Agent Actions:** Temporarily disable the browser's ability to take autonomous actions (e.g., "Buy for me" or "Message for me") in settings.
- **Log Out of Sensitive Sites:** Maintain strict session hygiene by logging out of high-value accounts (Amazon, Banking, Social Media) when not actively in use.
## Detection
- **Indicators of Compromise:**
- Unexpected outbound messages in WhatsApp, Slack, or Email sent via the AI interface.
- Unauthorized order history in e-commerce accounts.
- AI "chat history" logs showing interactions or commands not initiated by the user.
- **Detection Methods:** Audit logs of the AI Agent's activity; monitor for "Prompt Injection" patterns in browser-render history.
## References
- Zenity Research: hxxps[://]www[.]zenity[.]io/blog/
- Black Hat Briefings: hxxps[://]www[.]blackhat[.]com/us-26/briefings/
- Original Reporting: hxxps[://]www[.]wired[.]com/story/openai-atlas-browser-hijacked-security-zenity/