cyber.hendryadrian.com
Security News · bleepingcomputer.com

BioShocking Prompt Injection Tricked Six AI Browser Agents in LayerX Test

· Original article ↗

Summary

LayerX says its BioShocking proof of concept tricked six AI browser agents into treating sensitive actions as a game. The researchers say ChatGPT Atlas received the only effective fix; the PoC did not perform malicious actions.

Key points

  • LayerX’s BioShocking proof of concept used a fake BioShock-themed puzzle to weaken AI browser agents’ safety boundaries.
  • The final puzzle step instructed agents to visit a GitHub repository and share code data, potentially including passwords.
  • LayerX says all six tested agents failed to recognize the requested credential-compromising action as unsafe; the PoC did not actually carry out malicious actions.
  • LayerX says OpenAI implemented an effective fix in ChatGPT Atlas. It describes Anthropic’s Chrome plugin patch as ineffective and says Perplexity closed its report without a fix.
  • LayerX recommends user confirmation for sensitive actions, stronger context checks, and limits on agent sessions; users should restrict agents’ access to sensitive services.

Article Details

Event Type
LayerX-reported prompt injection proof of concept targeting AI-powered browsers
Impact
The BioShocking PoC tricked six agentic browser products into treating real-world sensitive actions as part of a fictional game; the final step could expose data such as passwords. LayerX says the PoC did not actually perform malicious actions. OpenAI implemented a working fix for ChatGPT Atlas; LayerX says Anthropic’s attempted patch was ineffective and Perplexity AI closed the report without a fix.

Vendors

AnthropicAnthropic attempted to fix the problem on its Chrome plugin, but the patch is ineffective against the PoC, LayerX says.OpenAIThe PoC worked against six major agentic browser products, with OpenAI’s ChatGPT Atlas being the only one to receive a working fix so far.PerplexityPerplexity AI closed the report without fixing the issue, the researchers note in the report.

Products

ChatGPT AtlasThe PoC worked against six major agentic browser products, with OpenAI’s ChatGPT Atlas being the only one to receive a working fix so far.Claude Chrome pluginagentic browser products (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome plugin), with only one addressing it after receiving the report.Comet#BioShockingFellou#BioShockingGenspark Browsersuccessfully tested against six mainstream agentic browser products (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome plugin), with only one addressing it after receiving theSigma Browseragainst six mainstream agentic browser products (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome plugin), with only one addressing it after receiving the report.

Related Articles