AI BROWSER SECURITY - THREAT ANALYSIS

The AI browser everyone warned about is gone. The agent moved into Chrome.

ChatGPT Atlas stopped working on 9 August 2026. Its agentic browsing did not stop; it was folded into a Chrome extension and the ChatGPT desktop app. Which means the flaw researchers spent a year documenting now sits in the browser you were already using.

SB

SafeBrowz Threat Research Security Research · 23 August 2026 · 12 min read

What actually shut down, and what did not

OpenAI launched Atlas in October 2025 and announced on 9 July 2026 that it was sunsetting it. The browser stopped working on 9 August 2026, after less than a year.

It would be convenient to write that headline as security finally catching up with a rushed product. That is not what happened, and saying so would be inventing a story. OpenAI's stated reasoning was product focus. TechCrunch, reporting the announcement, summarised the conclusion as the browser being a feature rather than the destination, and noted the same round of cuts that ended the Sora video tool. The agentic browsing work was redistributed into the ChatGPT desktop app and a Chrome extension that can read the page you are on.

Read that last sentence again, because it is the whole reason this article exists. The standalone AI browser is what went away. The thing that made it risky is an assistant with permission to read pages and act on your behalf, and that has now been installed into Chrome, next to your mail, your bank and every session you are signed into. The attack surface did not shrink. It relocated to where the users are.

The flaw is not a bug in one product

On 20 August 2025, Brave published research by Artem Chaikin, written with Shivan Kaul Sahib, showing indirect prompt injection against Perplexity's Comet browser. The mechanism is almost insultingly simple.

When you ask an assistant to summarise a page, the page content and your request go to the model together. The model sees one stream of text. It has no dependable way to mark one part as "my user asked this" and the other as "some stranger wrote this". So an attacker writes instructions into the page, and when your agent reads them, it may follow them.

Brave's proof of concept used a Reddit comment with hidden instructions. A user asks Comet to summarise the thread. Comet reads the hidden text, goes and retrieves the user's account details, and sends them to the attacker.

What happened next is the part worth quoting exactly, because it is usually reported as "Perplexity patched it" and that is not what Brave's own disclosure log says. Perplexity acknowledged the report and shipped an initial fix. Brave retested on 28 July 2025 and found the fix incomplete. A further round of testing on 13 August appeared to confirm it was patched, and Brave disclosed publicly on 20 August. Then they appended an update to that same post: on further testing after publication, they learned Perplexity still had not fully mitigated the attack, and re-reported it.

So the honest state of that specific case is not "fixed". It is a fix, an incomplete retest, a second fix, and a public correction, which is a fair picture of how hard the underlying problem is. In October 2025 Brave published a follow-up covering more browsers and a nastier variant, and stated the structural problem plainly: agentic browser assistants can be prompt-injected by untrusted webpage content, which renders protections such as the same-origin policy irrelevant, because the assistant executes with the user's authenticated privileges. Same-origin policy is the rule that stops one website reading another's data in your browser. It is one of the foundations the web's security rests on, and an agent acting as you walks straight past it, because as far as the browser is concerned, you are the one doing it.

You are not reading the same page your agent is

The obvious question is why nobody notices a page full of malicious instructions. The answer is that the instructions are written for a reader that is not you.

Unit 42 catalogued the concealment methods found on real pages: font size set to zero, elements positioned thousands of pixels off screen, zero opacity, white text on a white background. Then the less obvious ones. Instructions split across multiple elements so no single one looks wrong. Text encoded as HTML entities, or base64 that only becomes an instruction when JavaScript decodes it at runtime. Words drawn onto a canvas. Zero-width invisible characters inserted between letters, and Cyrillic characters standing in for Latin ones, both aimed at slipping past anything scanning for known phrases.

That last pair is familiar territory here. Folding lookalike characters back to Latin before judging a name is something we already do when reading a domain, because the same trick is decades old in phishing hostnames. Seeing it reused to smuggle instructions past a filter is a good reminder that attacker technique migrates across categories faster than defences do.

Brave then removed the last comfort. In research published on 21 October 2025 they showed injections that survive being screenshotted, using faint light blue text on a yellow background: illegible to a person, perfectly readable to an assistant extracting text from the image. They demonstrated the screenshot path against Comet and a navigation-based variant against the Fellou browser, where simply navigating to a page was enough to send its content to the model. Opera Neon was also named.

So "look carefully before you trust a page" fails here, not because people are careless, but because the instruction was never rendered for human eyes.

It stopped being theoretical in March

For most of 2025 this stayed a researcher's demonstration. On 3 March 2026, Unit 42 published a study by Beliz Kaleli, Shehroze Farooqi, Oleksii Starov and Nabeel Mohamed finding it live on the open web. Their conclusion was that indirect prompt injection is no longer merely theoretical but is being actively weaponized.

What the injected instructions actually told agents to do is the part worth sitting with:

• Move money. One page carried an instruction to transfer 5,000 dollars to an attacker-controlled account.
• Buy things. Multiple pages attempted to force purchases, including a subscription upgrade and a pair of running shoes, which sounds trivial until you remember it means the agent was expected to reach a stored payment method.
• Destroy data. One instruction simply said to delete your database, aimed at agents with backend access.
• Take the machine down. Another deployed a Linux fork bomb to exhaust resources on whatever executed it.
• Corrupt automated decisions. The first case they describe was built to fool an AI advertisement review system, and others targeted search ranking and automated hiring systems.

Two of their measurements are worth carrying away. Social engineering was the dominant jailbreak technique at 85.2 percent, meaning most of these injections do not try to break the model with clever syntax; they simply lie to it, framing the request as a security update or a test. And 37.8 percent of injections were delivered as ordinary visible plaintext, often sitting in a page footer, relying on the fact that nobody reads footers and the model reads everything.

We have deliberately not turned the sites Unit 42 names into red examples on this page. At least one of them is a long-standing legitimate site that appears to have been compromised rather than built for this, and marking a real business as an attacker's domain would be a worse error than leaving the list out. The behaviour is the lesson; the hostnames are not.

Six agents, one trick, and four vendors who said nothing

On 29 June 2026, LayerX researcher Roy Paz published a technique named BioShocking, after the game in which the player is manipulated into obedience by a trigger phrase. The idea is to convince the agent that it is not operating in the real world. Once it accepts a fictional frame, the safety training that would refuse a harmful request stops applying, because in the fiction there are no consequences.

The test was a puzzle page themed on the game, built so that wrong answers are rewarded and two plus two comes to five. Five agentic browsers and one agentic plugin were asked to play: ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser and Anthropic's Claude Chrome plugin. Once each agent accepted that incorrect answers were the rules here, the puzzle's final step told it to visit a path and copy what it found, and that path redirected into the user's own authenticated session, where it retrieved login credentials and passed them on. LayerX reports all six failed to recognise that step as something their safety guardrails should have stopped, with one agent celebrating the exfiltration as a win.

Worth keeping the scale honest: this was a controlled test with a plaintext file, not a live theft. What makes it matter is where the redirect could point instead, which is any tab, repository or internal tool the person happens to be signed into at that moment.

LayerX published their disclosure log, and it is more revealing than the exploit:

• OpenAI (ChatGPT Atlas), reported 30 October 2025 - fixed.
• Perplexity AI (Comet), reported 20 October 2025 - closed and ignored.
• Fellou, reported 30 October 2025 - no response.
• Genspark, reported 30 October 2025 - no response.
• Sigmabrowser, reported 30 October 2025 - no response.
• Anthropic (Claude Chrome plugin), reported 26 January 2026 - patch failed.

One vendor of six fixed it. Three never replied at all. We will note without softening it that Anthropic, whose models we use in our own analysis layer, is on that list with a patch that did not hold. Leaving that out because it is inconvenient would make the rest of this page worth less.

The number that matters even if you never open an AI browser

Underneath the agent question sits a duller one that is arguably more relevant to most people: how good are these products at the ordinary job of not loading a phishing page?

LayerX tested that. Against 103 real-world phishing attacks, they report ChatGPT Atlas allowed 97 through, a 94.2 percent failure rate, blocking 5.8 percent. On the same set they measured Microsoft Edge at 53 percent and Google Chrome at 47 percent. A separate LayerX comparison put Edge at 54 percent, Chrome at 47 percent, Dia at 46 percent, and Comet and Genspark at 7 percent each.

One caveat, stated up front: LayerX sells browser security software and reports its own product at 98 percent in the same research, so these are vendor figures with a commercial interest attached, not an independent benchmark. Treat the exact percentages with that in mind. The gap is still large enough to be the point. Chrome and Edge stopping roughly half of phishing pages is not impressive either, and it is the number a lot of people are unknowingly relying on as their only protection.

Red flags that an agent is being played

You will not see the injection. You can see its consequences, and they have a recognisable shape.

• An answer that includes an action you did not ask for. You asked for a summary and it also opened a page, filled a field, or offered a link. Summarising does not require going anywhere.
• A link you did not choose the source of. The destination came from the page, not from you. That is the one moment in this whole chain where an ordinary check still works.
• Any approval prompt that appears while browsing, rather than because you started something. A permission or payment confirmation you did not initiate should be read completely, not clicked through.
• Urgency inside a machine-to-machine flow. Social engineering was Unit 42's most common jailbreak technique, dressing the instruction as a security update or a required test. Language that exists to hurry a human is a strange thing to find in a page footer.
• The agent citing an instruction as though it were yours. Phrasing like "as requested, I have sent" for something you never requested is the clearest tell there is.

Flag the destination, because that is the part that still has an address

Here is the honest boundary, and it matters more on this topic than on most.

SafeBrowz does not sit inside your agent's reasoning. We cannot see a hidden instruction in a page, we do not inspect what your assistant is thinking, and nothing we ship stops a model from being convinced by text it read. Anyone selling you a browser extension as a cure for prompt injection is overselling. The people closest to this problem are not promising a fix either; the research consistently frames it as a systemic property of how these assistants read the web, not a defect awaiting a patch.

What an injected instruction almost always needs is somewhere to go. A URL to send the data to, a page to download from, a login to land on. That destination is a domain, and a domain is something with a reputation, an age, a registration record and a page that can be read. That is the part we own, and it is unchanged by whether a person or an agent followed the link there. Layer 1 reads the shape of a link locally before the page renders. Layer 2 checks the destination against reputation sources, a brand database of more than 550 names and our blocklist. Layer 3 is the AI deep scan, a Premium feature with one free scan a day for everyone else, which reads what the page actually serves rather than what it claims to be.

There is also a version of this built for agents rather than people. Our AI connector lets an assistant in Claude or ChatGPT request a verdict on a URL before it acts, and return one of proceed, ask a human, or block. If you are wiring detection into something you are building yourself, the agent integration guide covers it properly. The limit is worth stating plainly rather than burying: an agent that has already been hijacked can simply decline to ask. A check the agent chooses to run helps most in the ordinary case, where the agent is working normally and the link is the thing that is wrong.

So the useful summary is narrow and, we think, true. We do not defend the agent's mind. We defend the address it was sent to, and for now that address is still the one part of this attack that has to be real.