Cybersecurity researchers at **Zenity** have unveiled a new class of vulnerabilities affecting AI-powered web browsers and browser extensions, dubbed "intent collision" attacks. These findings, presented at the **Black Hat** cybersecurity conference in Las Vegas, highlight how malicious instructions embedded in seemingly legitimate web content can manipulate AI agents into performing actions on behalf of the user, effectively compromising their accounts and data. The research identified approximately 20 flaws across various AI browsing tools, enabling researchers to access local machines, exfiltrate files, take over password managers, and leak entire browsing histories. "They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago," stated **Michael Bargury**, cofounder and CTO of **Zenity**, who presented the findings alongside **Zenity**'s **Stav Cohen**. ### The Rise of Agentic Browsers and Their Risks AI integrations in web browsers largely come in two forms: dedicated browsers with built-in AI assistants and extensions that add AI capabilities to existing browsers. These agents are designed to navigate websites, summarize content, and even take actions across multiple tabs, offering convenience but also introducing new security challenges. Security experts have long voiced concerns about exposing AI systems to untrusted web data, making them susceptible to malicious instructions and prompt-injection attacks. **OpenAI**'s security boss previously acknowledged prompt injection as an "unsolved security problem." Furthermore, traditional web security mechanisms, such as the **same-origin policy**, can be rendered "effectively useless" when AI agents are involved. ### OpenAI's Atlas Exploited Among the tools probed, **OpenAI**'s **Atlas** browser—which is slated for deprecation soon—was found to have the most robust security measures. However, **Zenity** researchers still managed to bypass these protections. Other AI browsing tools were reportedly much easier to exploit. In one proof-of-concept, researchers tricked **Atlas** into initiating a mass phishing campaign. By embedding malicious instructions in Hebrew within a seemingly innocuous newsletter sign-up page, they caused the AI to navigate to a user's logged-in **WhatsApp** web account and send the same message to every contact. This attack circumvented multiple **OpenAI** safety mechanisms, including language-based security tools and deceptive claims about operating in a sandboxed environment. "What it'll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm," Bargury explained. "So you are now infecting the rest of your friends and family." ### Unauthorized Purchases on Amazon Another demonstration involved **Amazon**. Using a similar "intent collision" technique, **Zenity** researchers made **Atlas** add a shipping address to a logged-in **Amazon** account and place a tablet in the shopping cart. While direct purchase attempts were blocked by **OpenAI**'s safety measures, the researchers found a workaround: they instructed **Atlas** to ask **Amazon**'s **Rufus** AI shopping assistant to complete the purchase. "**Rufus** was not hijacked or injected, it was just asked, by what it took to be the customer, and it complied," the researchers noted in their blog post. ### OpenAI's Response and Future Outlook **Zenity** reported their findings to **OpenAI** in January. An **OpenAI** spokesperson confirmed that an update was deployed to address the issue in **Atlas** and strengthen protections, which will extend to the browser capabilities in the new **ChatGPT** app. **OpenAI** also stated that prompt-injection attacks are an active area of research for the company. While these attacks are complex, **Zenity** emphasizes the need for "deterministic" or hard security barriers in AI system design, rather than relying solely on AI's judgment or classifications, which can often be deceived. "You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak," Bargury warned. "We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers."