OpenAI Browser Flaw Could Let Hackers Spam Your WhatsApp Contacts

OpenAI's Atlas browser could be manipulated by attackers to send messages to a user's WhatsApp contacts and carry out other actions without their knowledge, according to security researchers.

The findings, reported by WIRED, were presented at the Black Hat cybersecurity conference in Las Vegas. Researchers from security firm Zenity said they discovered around 20 security flaws in AI-powered browsers and browser extensions from several major technology companies.

Atlas Could Be Tricked Into Sending WhatsApp Messages

According to WIRED, Zenity researchers created a malicious webpage disguised as a legitimate newsletter sign-up page and got OpenAI's Atlas browser to interact with it.

The webpage contained hidden instructions in Hebrew that told the AI browser to open the user's signed-in WhatsApp Web account and send the same message to every contact.

Researchers described the attack as a potential mass phishing campaign. They said the technique did not exploit a vulnerability in WhatsApp itself. Instead, it relied on manipulating the AI browser into following malicious instructions embedded in a webpage.

The researchers called this type of attack an "intent collision", where an AI agent combines a legitimate instruction from the user with malicious instructions received from the web.

Researchers Also Tested Amazon

Zenity researchers also used a similar technique against Amazon. They managed to get Atlas to add a shipping address to a logged-in Amazon account and put a tablet into the shopping cart.

However, they were unable to make Atlas complete the purchase because of OpenAI's security controls.

The researchers then got Atlas to ask Amazon's Rufus AI shopping assistant to make the purchase. According to WIRED, the researchers said Rufus itself was not hacked or injected. Instead, it simply responded to what appeared to be a genuine request from the customer.

AI Browser Security Concerns

The findings highlight growing concerns around AI agents that can browse websites and take actions on behalf of users.

Unlike traditional browsers, AI-powered browsers can read webpage content and make decisions based on what they find. This creates a risk when websites contain instructions designed to manipulate the AI.

Zenity researchers said AI systems should rely on stronger, fixed security barriers rather than allowing AI models to decide whether an action is safe.

OpenAI said the researchers reported the findings in January. The company told WIRED that it had deployed an update earlier this year to address the issue and strengthen security protections in Atlas.

OpenAI also said Atlas is scheduled to be deprecated on August 9, while the strengthened protections have been extended to browser capabilities in the new ChatGPT app.

Researchers warned that if AI agents are given excessive access to browsers and user accounts, successful attacks could potentially lead to compromised accounts, leaked data and unauthorised actions.