OpenAI CISO Calls Prompt Injection 'Unsolved' as Atlas Browser Flaws Emerge

Security researchers at Zenity have demonstrated that OpenAI's Atlas AI browser can be manipulated via prompt injection to perform unauthorized actions on behalf of users. The findings highlight a critical vulnerability in how AI agents interact with web content, potentially turning a productivity tool into a vector for account hijacking.

According to the researchers, the Atlas browser could be tricked into spamming a user's WhatsApp contacts and preparing unauthorized purchases on Amazon. These attacks did not rely on direct bugs within WhatsApp or Amazon themselves; instead, they utilized "prompt injection" and "intent collision" to steer the AI agent's behavior. These vulnerabilities are part of a systemic issue known as "indirect prompt injection," which affects a range of AI-powered browsers, including Perplexity's Comet.

The Confused Deputy Problem

OpenAI launched Atlas to integrate ChatGPT as an agent capable of automating complex tasks across the web, contributing to a new competitive landscape of AI-driven browsing. However, this autonomy introduces the "confused deputy" problem. In this scenario, an AI agent lacks the ability to distinguish between legitimate instructions provided by the user and malicious commands embedded within the content of a website the agent is visiting.

When an agent is granted the authority to execute authenticated actions—such as messaging or shopping—without requiring explicit user confirmation for every individual step, the security surface expands significantly. If the agent reads a hidden command on a webpage, it may execute that command as if it were a direct request from the account owner.

Industry Implications

OpenAI's Chief Information Security Officer, Dane Stuckey, has acknowledged the severity of the issue. Stuckey stated that prompt injection remains a "frontier, unsolved security problem," warning that adversaries will likely spend significant time and resources attempting to make ChatGPT agents fall for these attacks.

The implications for the broader industry are stark. If prompt injection cannot be mitigated, AI agents could be weaponized to commit financial fraud, steal sensitive data, or spread misinformation using the trusted identities of their users. The ability to automate authenticated web actions creates a high-stakes environment where a single malicious webpage could trigger a cascade of unauthorized account activities.

The Path Forward

As the industry grapples with these systemic flaws, OpenAI is sunsetting the Atlas browser, with a targeted deprecation date of August 9, 2026. The move suggests a pivot in how the company approaches agentic web interaction, though the underlying challenge of prompt injection remains a hurdle for any developer seeking to build autonomous AI browsers. For now, the industry remains in a race to find a technical solution that can reliably separate user intent from external influence.