cyber.hendryadrian.com
Security News · securityweek.com

BioShocking Attack Manipulates AI Browsers Into Retrieving Credentials

· Original article ↗

Summary

LayerX demonstrated that a game-themed webpage could manipulate tested AI browsers into retrieving sensitive SSH credentials in a controlled test. OpenAI patched the issue; responses from other vendors varied.

Key points

  • LayerX used a puzzle inspired by BioShock to manipulate six agentic browsers into treating incorrect actions as acceptable.
  • In the controlled test, navigating to /code redirected to a work GitHub repository, where malicious instructions fetched sensitive SSH credentials.
  • LayerX said the technique could potentially direct an agent to other tabs, authenticated repositories, or internal tools.
  • LayerX recommended confirmation for sensitive operations, context checks, and limits on agent actions; users should review browser access and revoke it when sessions end.
  • LayerX reported the findings to six vendors. OpenAI patched the issue; Anthropic's patch failed, Perplexity AI ignored the report, and Fellou, Genspark, and Sigmabrowser OU did not respond.

Article Details

Event Type
Security research disclosure of the BioShocking manipulation attack against agentic browsers
Impact
In a controlled test, researchers found that a puzzle could manipulate agentic browsers into treating unsafe actions as part of a game and retrieving sensitive SSH login credentials from a work GitHub repository. The researchers warned that the technique could potentially expose data or direct agents to authenticated repositories, other browser tabs, or internal tools. The test file was harmless. OpenAI patched the issue; Anthropic's patch failed; Perplexity AI did not act on the report; and Fellou, Genspark, and Sigmabrowser OU did not respond.

Vendors

AnthropicOpenAI patched the issue, Anthropic’s patch failed, Perplexity AI ignored the report, and Fellou, Genspark, and Sigmabrowser OU never responded.FellouPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.GensparkPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.OpenAIOpenAI patched the issue, Anthropic’s patch failed, Perplexity AI ignored the report, and Fellou, Genspark, and Sigmabrowser OU never responded.PerplexityOpenAI patched the issue, Anthropic’s patch failed, Perplexity AI ignored the report, and Fellou, Genspark, and Sigmabrowser OU never responded.Sigmabrowser OUOpenAI patched the issue, Anthropic’s patch failed, Perplexity AI ignored the report, and Fellou, Genspark, and Sigmabrowser OU never responded.

Products

ChatGPT AtlasPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.Claude ChromePer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.CometPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.FellouPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.Genspark BrowserPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.Sigma BrowserPer the game’s rules, incorrect actions were deemed acceptable, and the tested agentic browsers, namely ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, quickly learned that.

Related Articles