ChatGPT Atlas Browser Can Be Tricked by Fake URLs into Executing Hidden Commands

OpenAI’s Atlas web browser, released recently, has been shown to be vulnerable to a prompt injection attack that can jailbreak its omnibox by disguising instructions as a seemingly harmless URL. According to NeuralTrust, an attacker can craft a URL-like string that the omnibox treats as high-trust user intent text, enabling harmful actions such as prompting the AI to visit attacker-controlled sites or execute embedded commands.

The malicious input typically begins with “https” and uses text resembling a domain (for example “my-wesite[.]com”) to slip instructions into the prompt, bypassing URL validation. In a hypothetical scenario, a link behind a Copy link button could lead victims to phishing pages or even trigger commands to delete files from connected apps like Google Drive, as noted by security researchers.

The disclosure follows demonstrations that threat actors may spoof AI assistants via browser extensions or native sidebars, a tactic linked to broader concerns around prompt injections in AI-powered browsers like Atlas, Perplexity Comet, and Opera Neon.