Researchers hack OpenAI's Atlas browser and make a purchase on Amazon without the user's knowledge

Researchers at Zenity have found more than 12 vulnerabilities in AI browsers and demonstrated that OpenAI's Atlas browser can be forced to make an unauthorized purchase on Amazon and to spam all of a user's WhatsApp contacts, all without the user's knowledge or consent.

What Zenity found

Zenity, which specializes in AI agent security, ran a systematic audit of several AI browsers. These are next-generation tools that let language models act on their own on the internet: click, fill in forms, make purchases and send messages. According to Wired, it is exactly this autonomy that turned out to be the main weakness.

• More than 12 vulnerabilities identified across different AI browsers
• One of the key test targets was OpenAI Atlas
• Hack demonstration: an unauthorized purchase of an item on Amazon
• Second vector: mass spam sent to the user's contacts via WhatsApp
• The research was published in Wired by Zenity

How an AI browser gets hijacked

Atlas is OpenAI's AI browser. It can operate web pages the way a human does: see content, click buttons, enter data and carry out multi-step tasks. Zenity's researchers used a technique called prompt injection against it, which means planting foreign instructions through malicious content on a web page.

When Atlas visited a specially prepared site, it read hidden instructions as trusted commands from the user and carried them out. In the demonstration scenario, the browser placed a real order on Amazon while the user suspected nothing. The attack runs in the background: an AI agent is autonomous by nature, so the user may not notice the suspicious action in time.

"AI agents act on the user's behalf and have access to their accounts, which makes vulnerabilities in them more dangerous than in ordinary software," the

Zenity researchers state in their report, published by Wired.

WhatsApp spam: a real threat to contacts

The second scenario the researchers demonstrated puts reputation at risk rather than money. The attacker forces the AI browser to send spam through WhatsApp to the user's entire address book. To the recipient, the message looks like it came from someone they know, which sets up ideal conditions for phishing.

Meanwhile, the owner of the compromised browser may not realize for a long time that their agent has been sending unwanted messages. If the user has several hundred contacts in WhatsApp, the attack instantly reaches a wide circle of people, and all of it happens without a single click from the victim.

What this means

AI browsers are a fundamentally new class of software, and security standards for them have yet to take shape. The Zenity research shows that products are reaching the market faster than the work on defending them. While OpenAI and other developers expand what their agents can do, how well those agents resist outside manipulation remains an open question. Users should be careful about granting AI browsers broad permissions, especially access to financial accounts and messaging apps.

Frequently asked questions

What is prompt injection in AI browsers?

Prompt injection is an attack in which malicious instructions are planted in data the AI agent processes as it works, for example hidden text on a web page. The agent treats them as trusted commands from the user and takes actions the user never requested, up to and including purchases and sending messages.

Can OpenAI Atlas really charge money without permission?

Yes. That is exactly what the Zenity researchers demonstrated: the browser placed a real order on Amazon during a controlled experiment. The attack is possible when the agent has been given access to an account with saved payment details.

*Meta has been designated an extremist organization and is banned in Russia.