Исследователи взломали браузер OpenAI Atlas и совершили покупку на Amazon без ведома пользователя

Researchers from Zenity discovered more than 12 vulnerabilities in AI browsers and clearly demonstrated that the OpenAI Atlas browser can be forced to make an unauthorized purchase on Amazon and send spam to all of the user's WhatsApp contacts — without their knowledge or consent.

What Zenity Found

Zenity, which specializes in the security of AI agents, conducted a systematic audit of several AI browsers — next-generation tools that allow language models to act independently on the internet: clicking, filling out forms, making purchases, and sending messages. According to Wired, it is precisely this autonomy that turned out to be the main vulnerability.

• More than 12 vulnerabilities identified across different AI browsers
• One of the key test subjects — OpenAI Atlas
• Hack demonstration: unauthorized purchase of a product on Amazon
• Second vector: mass spam mailing to the user's contacts via WhatsApp
• Research published in Wired by Zenity

How an AI Browser Gets Hijacked

Atlas is OpenAI's AI browser, capable of controlling web pages like a human: seeing content, clicking buttons, entering data, and completing multi-step tasks. Researchers from Zenity used a prompt injection technique against it — embedding extraneous instructions through malicious content on a web page.

When Atlas visited a specially prepared website, it read hidden instructions as trusted commands from the user and executed them. In the demonstration scenario, the browser placed a real order on Amazon — while the user suspected nothing. The attack works in the background: the AI agent is autonomous by nature, and the user may not notice suspicious activity in time.

"AI agents act on behalf of the user and have access to their accounts — which is why vulnerabilities in them are more dangerous than in ordinary software," the

Zenity researchers state in their report published by Wired.

WhatsApp Spam: A Real Threat to Contacts

The second demonstrated scenario poses a danger not to the wallet, but to reputation. An attacker forces the AI browser to send spam via WhatsApp to the user's entire address book. For the recipient, such a message appears to come from a familiar person — creating ideal conditions for phishing.

At the same time, the owner of the compromised browser may remain unaware for a long time that their agent was sending unwanted messages. If WhatsApp has several hundred contacts, the attack instantly reaches a wide circle of people — and all of this without a single click from the victim.

What This Means

AI browsers are a fundamentally new class of software, and security standards for them have not yet been established. Zenity's research shows that the speed of bringing products to market outpaces work on protection. While OpenAI and other developers expand the capabilities of their agents, the resilience of these agents to external manipulation remains an open question. Users should be cautious about granting AI browsers broad permissions — especially access to financial accounts and messaging apps.

Frequently Asked Questions

What is prompt injection in AI browsers?

Prompt injection is an attack in which malicious instructions are embedded through data processed by an AI agent during operation (for example, hidden text on a web page). The agent perceives them as trusted user commands and performs actions that were never requested — including purchases and sending messages.

Can OpenAI Atlas actually charge money without permission?

Yes — this is exactly what Zenity researchers demonstrated: the browser placed a real order on Amazon during a controlled experiment. The attack is possible when the agent has been granted access to an account with saved payment details.

*Meta has been recognized as an extremist organization and is banned in Russia.