BioShocking attack tricks AI browsers into leaking user credentials through disguised game

New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials

Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. The targets included OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. An AI browser is one that can act for you, not just read pages. Switch it to agent mode, and it can click, type, and reach into the sites you are already signed into. That access is the whole point, and it is also the problem. The trick works because of how these agents read. The web page and your own instructions arrive as a single stream of text. That lets a malicious page slip in commands dressed up as ordinary content or game rules, and the agent cannot reliably tell the difference. Researchers call this indirect prompt injection. How the trick works The attack starts with a web page built as a puzzle. To fit its dystopian theme, the puzzle rewards wrong answers, like insisting that 2 + 2 = 5. Once the agent accepts that "wrong" is the winning move, it follows game logic instead of safety logic. The final step of the puzzle asks it to grab the user's credentials, and not one of the six agents flagged that as something it should refuse. The dangerous part is where the agent looks. In the test, a link was sent to the victim's work GitHub repository, where it pulled SSH login credentials and passed them to the attacker. LayerX used a harmless plaintext file, but the same trick could point the agent at other resources it can reach in that session: open tabs, signed-in accounts, and internal tools. The agent did not hesitate. Afterward, it cheerfully reported the theft as a win. The name nods to BioShock, where a brainwashed character obeys the trigger phrase "Would you kindly?" The agent is no different. It trusts the context it is handed. Change the context, and you change what it will do. LayerX has shown this pattern before, demonstrating that a single click could hijack Perplexity's Comet and quietly steal data. What the vendors did, and what to do By LayerX's account, the responses were uneven. It reported the issue to vendors between October 2025 and January 2026. OpenAI fixed it in ChatGPT Atlas. Perplexity closed the report without acting on it. Fellou, Genspark, and Sigma did not respond. Anthropic tried to patch its Claude extension, but LayerX says the fix did not hold. To shut the attack down, LayerX wants AI browsers to ask before reading from logged-in accounts. One prompt, "I'm about to copy data from your GitHub repository. Continue?", would break the chain. It also wants agents to notice when a page tells them the normal rules no longer apply, and to let users set hard limits on what an agent can touch. Winning a game is no reason to open a private repository. For users, the advice is shorter. Treat agent mode with care: whatever you are signed in to is fair game, so decide what the browser should see and cut that access when you are done. For security teams, the same logic scales up. An AI browser in agent mode is effectively another account with reach into company systems, and it should get the narrowest access a task needs rather than a standing pass to everything the user can touch. The common thread across these findings is that handing an AI agent the keys to your signed-in accounts turns a jailbreak from a party trick into real access.

AI browsers like Perplexity Comet can be tricked into spilling your password through BioShocking exploit

Six AI browsers were found leaking saved passwords and many of them haven't fixed it yet. Security researchers just found a strange way to trick AI browsers into handing over your passwords. They managed to trick AI browser agents into exposing sensitive data like saved passwords, session cookies, and private tokens by disguising the theft as part of a harmless "game." The technique is called BioShocking, named after the popular video game BioShock, where a brainwashed character is manipulated into believing a false reality. Once an AI browser falls for the same trick, it stops following its own safety rules entirely. How BioShocking tricks AI into breaking its own rules AI browsers are built with guardrails to avoid exposing your data, but researchers at LayerX found a clever workaround. The attack starts on a malicious webpage with hidden prompts telling the AI it has entered a game to find secret strings. Since AI browsers rely heavily on context, that framing changes everything. The page presents a BioShock-style puzzle where wrong answers earn points, encouraging logic like two plus two equals five. Once the AI accepts that logic, its safety rules weaken. The AI was told the next step of the game was to find and copy a hidden code from another page which secretly led straight to the user's private login information. Recommended Videos In short, a request for saved passwords, which is normally blocked, gets reframed as just another game objective, letting the AI hand over sensitive data without recognizing the risk. Which AI browsers fell for the BioShocking attack? All six AI browsers that were tested copied real credentials and sent them straight to the attacker, then treated the whole thing as a win. The proof of concept worked against ChatGPT Atlas, Perplexity's Comet, Fellou, Genspark Browser, Sigma Browser, and Anthropic's Claude extension for Chrome. LayerX notified every vendor of its findings between October 2025 and January 2026, before going public. OpenAI fixed the issue in ChatGPT Atlas, while Perplexity closed the report without acting on it. Anthropic attempted a fix for its Claude extension, but LayerX says the patch did not hold up. Meanwhile, Fellou, Genspark, and Sigma never responded. As AI browsers grow more common, BioShocking shows how easily they can be talked into making the wrong call.