Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user’s credentials and sending them to an attacker.
The targets included OpenAI’s ChatGPT Atlas, Perplexity’s Comet, and Anthropic’s Claude browser extension.
An AI browser is one that can act for you, not just read pages. Switch it to agent mode, and it can click, type, and reach into the sites you are already signed into. That access is the whole point, and it is also the problem.
The trick works because of how these agents read. The web page and your own instructions arrive as a single stream of text. That lets a malicious page slip in commands dressed up as ordinary content or game rules, and the agent cannot reliably tell the difference. Researchers call this indirect prompt injection.
How the trick works
The attack starts with a web page built as a puzzle. To fit its dystopian theme, the puzzle rewards wrong answers, like insisting that 2 + 2 = 5. Once the agent accepts that “wrong” is the winning move, it follows game logic instead of safety logic. The final step of the puzzle asks it to grab the user’s credentials, and not one of the six agents flagged that as something it should refuse.
The dangerous part is where the agent looks. In the test, a link was sent to the victim’s work GitHub repository, where it pulled SSH login credentials and passed them to the attacker.
LayerX used a harmless plaintext file, but the same trick could point the agent at other resources it can reach in that session: open tabs, signed-in accounts, and internal tools. The agent did not hesitate. Afterward, it cheerfully reported the theft as a win.
The name nods to BioShock, where a brainwashed character obeys the trigger phrase “Would you kindly?” The agent is no different. It trusts the context it is handed. Change the context, and you change what it will do.
LayerX has shown this pattern before, demonstrating that a single click could hijack Perplexity’s Comet and quietly steal data.
What the vendors did, and what to do
By LayerX’s account, the responses were uneven. It reported the issue to vendors between October 2025 and January 2026. OpenAI fixed it in ChatGPT Atlas. Perplexity closed the report without acting on it.
Fellou, Genspark, and Sigma did not respond. Anthropic tried to patch its Claude extension, but LayerX says the fix did not hold.
To shut the attack down, LayerX wants AI browsers to ask before reading from logged-in accounts. One prompt, “I’m about to copy data from your GitHub repository. Continue?”, would break the chain.
It also wants agents to notice when a page tells them the normal rules no longer apply, and to let users set hard limits on what an agent can touch. Winning a game is no reason to open a private repository.
For users, the advice is shorter. Treat agent mode with care: whatever you are signed in to is fair game, so decide what the browser should see and cut that access when you are done. For security teams, the same logic scales up.
An AI browser in agent mode is effectively another account with reach into company systems, and it should get the narrowest access a task needs rather than a standing pass to everything the user can touch.
The common thread across these findings is that handing an AI agent the keys to your signed-in accounts turns a jailbreak from a party trick into real access.
