Crafted URLs can trick OpenAI Atlas into running dangerous commands

OpenAI Atlas, a browser with built‑in ChatGPT, was launched last week to help users summarise pages, edit text inline, and perform agentic tasks, but researchers warn that Atlas’s omnibox can be manipulated by prompt injection through crafted URL‑like strings. According to NeuralTrust, attackers can disguise malicious instructions as URLs in the omnibox, which Atlas interprets as trusted user intent rather than navigation targets, allowing the embedded commands to run with elevated trust.

The technique relies on disguising prompt instructions as benign‑looking links that fail URL validation, so Atlas treats them as prompts instead of navigating away. Real‑world abuses described include a copy‑link trap that can open attacker‑controlled phishing sites and prompts that instruct the agent to delete files from a user session, bypassing safety checks.

To mitigate these risks, experts recommend strict URL validation, avoiding automatic switching to prompt mode, treating prompts as untrusted, and requiring confirmations for risky actions, along with stripping instructions from URLs and including malformed URL tests in red‑team evaluations. According to NeuralTrust, “When powerful actions are granted based on ambiguous parsing, ordinary‑looking inputs become jailbreaks.” 27 October 2025