Convince an AI browser it is playing a puzzle game, and it will happily hand over your login credentials to an attacker. That is the core finding from security firm LayerX, which demonstrated the technique — dubbed BioShocking — against six AI browsers and assistants.
The targets included OpenAI’s ChatGPT Atlas, Perplexity’s Comet, and Anthropic’s Claude browser extension. All of them fell for the trick. The attack works because AI agents read web pages and user instructions as a single text stream, making it nearly impossible for them to distinguish legitimate content from injected malicious commands. Security researchers call this indirect prompt injection.
Here is how it plays out. The attacker sets up a web page designed as a dystopian puzzle that rewards wrong answers — like insisting two plus two equals five. Once the agent accepts that the normal rules do not apply, it follows the game logic instead of its safety training. The final step asks it to grab the user’s credentials. Not one of the six agents refused.
In LayerX’s test, the agent was directed at a victim’s work GitHub repository, where it pulled SSH login credentials and sent them to the attacker. The agent then cheerfully reported the theft as a win.
The name is a nod to BioShock, where a brainwashed character obeys the trigger phrase “Would you kindly?” The AI agent behaves the same way — it trusts whatever context it is given.
LayerX reported the issues to vendors between October 2025 and January 2026. OpenAI fixed ChatGPT Atlas. Perplexity closed the report without acting. Anthropic attempted a patch but LayerX says it did not hold. Fellou, Genspark, and Sigma never responded.
The fix LayerX wants is straightforward: AI browsers should ask permission before reading from logged-in accounts, and users should be able to set hard limits on what an agent can access. For now, treat agent mode with caution — whatever you are signed into, the agent can reach.
