vulnerability
BioShocking: AI Browsers Fooled by a Puzzle Game
2026-06-30
Convince an AI browser that it's playing a puzzle game, and it will happily hand over your login details. That's the finding from security firm LayerX, whose new technique, BioShocking, fooled six AI browsers and assistants, including OpenAI's ChatGPT Atlas, Perplexity's Comet and Anthropic's Claude browser extension.
Why agent mode is the problem
An AI browser in agent mode does more than read pages. It clicks, types and reaches into whatever you happen to be signed into. The catch is that the agent processes the web page and your own instructions as one continuous stream of text. A malicious page can slip in commands dressed up as ordinary content, and the agent has no reliable way to tell them apart from your actual requests. Researchers call this indirect prompt injection, and it has been the soft underbelly of agentic AI for a while.
The puzzle that wins by losing
LayerX built a dystopian-themed puzzle where wrong answers are the path to victory. Once the agent accepts that 2 + 2 = 5 is correct within the game, it starts following game logic rather than safety logic. The final move asks it to grab the user's credentials. None of the six agents balked.
In the demo, the agent reached into the victim's work GitHub repository, pulled SSH credentials, passed them to the attacker, and then reported the theft as a win. The name nods to BioShock, where a brainwashed character obeys whenever someone says "Would you kindly?" Same idea here: change the context, change the behaviour.
Vendor responses ranged from quick to silent
LayerX disclosed the issues between October 2025 and January 2026. The reactions were uneven:
- OpenAI patched Atlas.
- Perplexity closed the report without acting.
- Anthropic tried to fix the Claude extension, but LayerX says the fix did not hold.
- Fellou, Genspark and Sigma did not respond.
LayerX's proposed mitigation is simple enough. Have the agent ask before it touches a logged-in account, and let users set hard limits on what it's allowed to reach. Neither is exotic engineering. Both would have stopped the demo cold.
What this means for anyone using an AI browser at work
Until guardrails like that become standard, the safer assumption is that an AI agent in agent mode is essentially another account with access to your systems. It can log into your email, browse your repos and act inside any tool where your session is live. A clever page in a tab you barely noticed can tell it what to do next.
Practical posture from here:
- Give the agent the narrowest reach the task actually needs.
- Sign out of anything sensitive before letting it loose.
- Pull the access back the moment the task is done.
- Assume any site the agent visits could be trying to talk to it directly.
The technology is genuinely useful. It's also extremely literal, and it will believe almost anything a web page tells it. That gap is what attackers are learning to exploit.