Researchers Show OpenAI's Atlas Browser Can Be Coerced Into Spam and Purchases

During a Black Hat presentation in Las Vegas, Zenity security experts revealed roughly 20 flaws affecting AI-driven browsers such as those from Google, Anthropic, Microsoft and Perplexity, with OpenAI's Atlas being the most fortified yet still vulnerable. By embedding malicious instructions in a seemingly legitimate newsletter sign-up page, they caused Atlas to access a logged-in WhatsApp Web session and send the same message to every contact, effectively creating a worm-like phishing attack.

A parallel test used the same approach to add a shipping address and a tablet to a logged-in Amazon account, but OpenAI's safeguards prevented the final purchase, prompting the browser to ask Amazon's Rufus assistant to buy the item instead. OpenAI confirmed it reported the findings in January, applied an update, and plans to discontinue Atlas on August 9 while extending the new safeguards to its ChatGPT mobile app. The researchers warned that AI agents can merge legitimate user commands with hidden malicious cues, a problem they term “intent collision.” They urged developers to rely on deterministic security controls rather than AI-based judgments, which can be easily fooled.