OpenAI’s Atlas browser leaves the door wide open to prompt injection

OpenAI’s Atlas browser has been shown to be vulnerable to prompt injection through its Omnibox, where a specially crafted link pasted into the combined search and prompt bar can cause Atlas to treat input as a trusted user prompt rather than a URL. This can bypass safety checks and allow injected instructions to run with elevated trust, researchers say.

Axios reports that Atlas’s dual-purpose Omnibox opens fresh privacy and security risks for users, highlighting the trade-off between expanded functionality and guardrails. Researchers from Brave noted that AI-powered browsers capable of acting on your behalf are powerful yet risky, especially when you’re signed into sensitive accounts.

OpenAI has said it has implemented protections, and according to its help page: “Agent mode runs also operates under boundaries: System access: Cannot run code in the browser, download files, or install extensions; Data access: Cannot access other apps on your computer or your file system, read or write ChatGPT memories, access saved passwords, or use autofill data; Browsing activity: Pages ChatGPT visits in agent mode are not added to your browsing history.”