New ChatGPT Atlas Browser Exploit Lets Attackers Plant Persistent Hidden Commands

The Hacker News reports a new vulnerability in OpenAI’s ChatGPT Atlas browser that could allow attackers to inject malicious instructions into the AI’s memory and execute arbitrary code. The flaw hinges on a cross-site request forgery (CSRF) vulnerability that enables hidden instructions to taint ChatGPT’s persistent memory, meaning the corrupted memory can persist across devices and sessions.

LayerX Security describes the attack as dangerous because tainted memories can be triggered by normal prompts, potentially granting attackers control over a user’s account, browser, or connected systems. In demonstrations, researchers note that once memory is tainted, subsequent prompts can cause code fetches, privilege escalations, or data exfiltration without triggering safeguards.

The findings follow earlier demonstrations of prompt injections affecting ChatGPT Atlas and underscore concerns that AI browsers blend app, identity, and intelligence into a broader attack surface, with Edge and Chrome showing higher defence against such pages in testing. According to LayerX Security, memory-focused exploits pose a distinct risk, since the memory write can survive across browsers and sessions.