A new prompt injection attack dubbed “BioShocking” could trick AI-powered browsers into treating real-world risky actions as part of a fictional scenario, causing them to ignore any safety guardrails.
A proof-of-concept (PoC) for the attack, devised by researchers at LayerX, was successfully tested against six mainstream agentic browser products (ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome plugin), with only one addressing it after receiving the report.
How BioShocking works
LayerX created a proof-of-concept in which a malicious webpage presented a BioShock-themed puzzle game that rewards wrong answers. This teaches the browser’s control agent that normal rules do not apply.
In the final step for winning the game, the agent is instructed to visit a GitHub repository and copy and share data present in the code, including sensitive information such as passwords.
The main problem LayerX discovered in this exercise is that AI agents fail to distinguish between real-world sensitive operations and a given scenario.
Source: LayerX
“Once the agents figured out the rules and learned that ‘incorrect’ actions are acceptable, they were no longer tied to reality,” explains LayerX.
“When tasked with the final step of the puzzle – compromising user credentials – all 6 agents failed to identify it as going against their safety guardrails.”
LayerX’s PoC did not actually perform any malicious actions, but the researchers underline that it could do so without changing the outcome of the exercise.
AI vendors’ response
LayerX informed vendors of its findings in October last year and received no reply from three of them.
The researchers say that OpenAI was the only vendor that has implemented a working fix for BioShocking in its ChatGPT Atlas browser.
Anthropic attempted to fix the problem on its Chrome plugin, but the patch is ineffective against the PoC, LayerX says.
Perplexity AI closed the report without fixing the issue, the researchers note in the report.
LayerX recommends that vendors add explicit user confirmation for sensitive actions, stronger context checks, and scope limits for agentic sessions.
On their part, users should use the available options on their platform of choice to restrict AI browser access to sensitive services.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
