ChatGPT’s Atlas Browser Jailbroken to Hide Malicious Prompts Inside URLs

Security researchers have revealed a critical flaw in OpenAI’s Atlas browser that could let attackers bypass safety measures by disguising malicious prompts as innocent-looking URLs. The vulnerability hinges on Atlas’s omnibox, which combines URL entry with natural-language commands, allowing specially crafted strings to be misinterpreted as trusted user instructions.

When the browser fails to validate these strings as proper URLs, it can treat the entire input as a prompt for the AI agent, potentially triggering harmful actions from within an authenticated session. NeuralTrust Security Research identified and validated the vulnerability on 24 October 2025, and warns that attackers could exploit it by placing malformed URL strings behind seemingly safe “Copy link” buttons.

Mitigations suggested include stricter URL parsing, explicit navigation versus command modes, treating omnibox prompts as untrusted by default, and adding confirmation steps before cross-site actions. Organisations operating agentic browsers are urged to adopt these measures to reduce prompt-injection risks for users.