LayerX Security has demonstrated a new attack called BioShocking that targets AI browsers operating in autonomous agent mode. This attack uses indirect prompt injection, disguised as game instructions, to trick AI browsers into stealing user credentials. LayerX successfully compromised six different AI browsers and assistants, showing this is not a single-vendor issue but a broader architectural vulnerability in how AI agents interact with web content.
Attack Discovery and Response
Initial Discovery: Researchers at LayerX found that AI browsers in agent mode would execute instructions embedded in web content without distinguishing between legitimate user commands and malicious directives.
Proof of Concept: The team created a demonstration where malicious web content appeared as a game. When an AI browser visited the page, it interpreted the "game rules" as legitimate instructions, copied the user's credentials from the browser's password manager, and sent them to an attacker-controlled endpoint.
Vendor Response: LayerX reported the vulnerability to multiple vendors. OpenAI patched ChatGPT Atlas. Anthropic attempted a fix for its Claude extension, but it was ineffective. Perplexity closed the report without action.
Public Disclosure: After the standard disclosure period, LayerX published their findings, highlighting both the technical vulnerability and the inconsistent vendor responses.
Security Failures
Lack of Permission Boundaries: AI browsers had unrestricted access to browser APIs and stored credentials. There was no permission model to limit resource access during autonomous operations.
No Context Verification: AI agents could not differentiate between user-initiated commands and instructions from untrusted web content, treating all text as potentially actionable.
Missing Input Validation: Systems failed to flag suspicious actions—such as credential access followed by data transmission to a new domain—as requiring user approval.
Insufficient Isolation: AI agents operated with the same privilege level as the user's browser session, accessing password managers, cookies, and session tokens without additional authentication.
No Egress Filtering: Browsers did not monitor or restrict data transmission by AI agents. Credential exfiltration triggered no alerts or blocking mechanisms.
Compliance Standards and Requirements
OWASP ASVS v4.0.3 Requirement 4.1.1 mandates that applications enforce client-side security controls on the server side. AI browsers violated this by allowing client-side AI agents to bypass access controls without server-side verification.
NIST 800-53 Rev 5 Control AC-6 (Least Privilege) requires processes to execute with minimal privileges. AI agents running with full browser session privileges violate this principle. They should operate in a restricted context requiring explicit user approval for sensitive operations.
ISO/IEC 27001:2022 Control 8.3 (Information Access Restriction) demands restricted access to information and assets according to established policies. AI browsers failed to implement access restriction policies to prevent autonomous agents from accessing credential stores.
OWASP Top 10 2021: A01 (Broken Access Control) applies here. AI browsers allowed agents to access resources outside their intended permissions, treating web-embedded instructions as authorized commands.
PCI DSS v4.0.1 Requirement 8.3.1 states that all access to system components must use multi-factor authentication. While specific to payment environments, this principle extends to any system handling authentication credentials—AI agents accessing password managers should require additional verification.
Action Items for Your Team
Implement Explicit Approval Gates: Build approval workflows for sensitive operations. Credential access, file writes, and network calls should trigger user confirmation dialogs. Avoid silent, unrestricted access for agents.
Adopt a Permission Model: Create a tiered permission structure for AI operations. Define what an AI agent can access autonomously versus what requires user approval. Document and enforce this model at the API level.
Monitor Agent Behavior: Deploy logging to track AI tool access and transmission. Look for patterns like credential store access followed by external POST requests or unusual domains in network traffic. Set up alerts for these patterns.
Separate Agent Identity from User Identity: Run AI agents with their own service accounts with explicitly scoped permissions. This creates an audit trail and limits the impact if an agent is compromised.
Test with Adversarial Inputs: Include indirect prompt injection in your security testing. Create test cases where external content tries to command your AI tools. Ensure your systems reject or flag these attempts.
Review Your AI Tool Vendors: Ask vendors specific questions about their permission models and how they distinguish user commands from web content. If responses are vague, quantify the risk.
Update Your Threat Model: Add "malicious instructions in web content" to your threat model if deploying AI agents. This is a new attack surface where the victim is an AI that can't inherently distinguish between trusted and untrusted text sources.
The BioShocking attack highlights the need to redefine security protocols in AI-driven browsers, emphasizing user control and context-aware safeguards. Your responsibility is to implement controls now that limit what AI tools can access in your environment.
