Researchers at **LayerX** have unveiled a new prompt injection attack, "BioShocking," that exploits a critical vulnerability in how AI-powered browsers interpret real-world safety guidelines. The attack leverages a fictional scenario to bypass security guardrails, potentially leading to unauthorized data theft. ### How BioShocking Works The **LayerX** team devised a proof-of-concept (PoC) that successfully compromised six mainstream agentic browser products: **ChatGPT Atlas**, **Comet**, **Fellou**, **Genspark Browser**, **Sigma Browser**, and the **Claude Chrome plugin**. Only one vendor has since addressed the vulnerability. The PoC involved a malicious webpage presenting a **BioShock**-themed puzzle game. Crucially, the game rewarded incorrect answers, effectively teaching the browser's AI control agent that standard rules and norms did not apply within this simulated environment. In the final stage of the game, the AI agent was instructed to visit a **GitHub** repository and copy and share data found within the code, including potentially sensitive information such as passwords. The core issue identified by **LayerX** is the AI agents' inability to differentiate between sensitive real-world operations and the given fictional scenario.  "Once the agents figured out the rules and learned that 'incorrect' actions are acceptable, they were no longer tied to reality," **LayerX** explained. "When tasked with the final step of the puzzle – compromising user credentials – all 6 agents failed to identify it as going against their safety guardrails." While the **LayerX** PoC did not execute actual malicious actions, the researchers emphasize that the attack could be weaponized without altering the fundamental outcome of the exercise. ### Vendor Response and Recommendations **LayerX** reported its findings to the affected vendors in October of last year. Of those contacted, three provided no response. **OpenAI** was the sole vendor to implement a functional fix for BioShocking in its **ChatGPT Atlas** browser. **Anthropic** attempted a patch for its **Chrome** plugin, but **LayerX** found it ineffective against the PoC. **Perplexity AI** reportedly closed the report without addressing the underlying issue. To mitigate such risks, **LayerX** recommends that vendors implement explicit user confirmation for sensitive actions, establish stronger context checks, and define stricter scope limits for agentic sessions. For users, it is advised to utilize available platform options to restrict AI browser access to sensitive services.