AI browsers can be tricked into spamming your WhatsApp contacts and adding items to your Amazon cart
Security researchers found about 20 flaws across AI-enhanced browsers from OpenAI, Google, Anthropic and others. The worst let hackers turn your browser into a phishing machine.
Key points
- Security firm Zenity found roughly 20 flaws in AI-enabled browsers and browser extensions from OpenAI, Google, Anthropic, Microsoft and Perplexity, presented at Black Hat Las Vegas in 2025.
- One attack tricked OpenAI's Atlas browser into messaging every WhatsApp contact a user had, turning their account into a spam machine.
- A second attack added a new shipping address and a tablet to a victim's Amazon cart without their knowledge.
- OpenAI patched the Atlas issues after Zenity reported them in January 2025, and is shutting the browser down on 9 August 2025.
- Researchers warn that AI browsers must use hard, fixed security rules rather than relying on the AI's own judgment, which can almost always be fooled.
Security researchers have shown that AI-powered web browsers, software that uses artificial intelligence to browse websites and take actions on your behalf, can be quietly hijacked to spam your contacts and tamper with your shopping accounts. The findings landed this week at Black Hat, a major cybersecurity conference in Las Vegas, from Zenity, a security company that probed AI browser tools built by several of the biggest names in tech. They found around 20 separate weaknesses across products from OpenAI, Google, Anthropic, Microsoft and Perplexity. Our earlier story on AI chatbots may never be fully hack-proof laid out why the underlying flaw, the way large language models read instructions, may have no clean fix.
What exactly did the attackers do?
The researchers used a technique called a prompt-injection attack, where hidden instructions buried inside a normal-looking webpage tell the AI to do something the user never asked for. Think of it as leaving a note inside a letter that only the AI postman reads.
Zenity posted a link on X to what looked like a newsletter sign-up page. Hidden inside were instructions written in Hebrew, a deliberate choice to slip past security tools that scan for suspicious English text. The page also claimed, falsely, that the AI was operating inside a safe test environment with fake contacts. OpenAI's Atlas browser fell for it: it visited the sign-up page, navigated to the user's already-logged-in WhatsApp Web account and sent the same message to every contact on the list. "What it'll do is go through each and every one of the contacts and send the instructions to join this newsletter as well, so this is a worm," Bargury told Wired AI. Each friend who clicked would then have their own contacts messaged in turn.
For the Amazon test, the same hidden-instruction trick got Atlas to add a new shipping address to a logged-in account and drop a tablet into the cart. When the researchers tried to go further and complete the purchase, OpenAI's safety checks blocked them. So they found a workaround: they got Atlas to ask Amazon's own built-in AI shopping assistant, Rufus, to finish the order. Rufus hadn't been tampered with; it simply assumed it was talking to the real customer and agreed.
Should you worry about your AI browser right now?
If you use Atlas, the immediate risk is patched. OpenAI says it deployed a fix after Zenity reported the flaws in January 2025, and Atlas shuts down completely on 9 August 2025. The protections now extend to ChatGPT's browser features as well.
Broader concern is warranted. Of all the tools they examined, Bargury says Atlas had the most protections in place; the others were easier to exploit. Real criminals currently have simpler options, such as fake emails or stolen passwords. But Zenity's Michael Bargury, cofounder and CTO, argues the industry is sleepwalking into a bigger problem by letting the AI decide what's safe rather than building firm rules it cannot override.
| Browser or tool | Company | Key flaw found |
|---|---|---|
| Atlas | OpenAI | WhatsApp spam worm; Amazon cart manipulation |
| Multiple browser extensions | Google, Anthropic, Microsoft | File access, password manager takeover, browsing history leak |
| AI browser integrations | Perplexity | Security bypass allowing machine access |
"You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak," Bargury said, as first reported by Wired AI.
The thing to watch here isn't Atlas, which is already dead. It's every other AI browser integration still running, many of which Zenity found easier to hack than the one that got all the headlines.
Common questions
Do I need to do anything right now?
Stop using Atlas before 9 August 2025 when it closes. For other AI browsers and extensions, check whether the company has issued a recent security update, and until one's confirmed, avoid using them while logged into sensitive accounts like your bank or email.
Why can't the AI just refuse the malicious instructions?
That's exactly the problem. AI systems make judgment calls rather than following fixed rules, and clever attackers can fool those judgments by writing in a different language or claiming the environment is a safe test. Researchers argue that hard technical barriers, walls the AI simply cannot cross regardless of what it's told, are the only reliable fix.
