BioShocking Attack: AI Browsers Leak User Credentials

A new technique called BioShocking can trick AI browsers into leaking user credentials. Security firm LayerX found that by convincing an AI browser it's playing a game, it can be manipulated into sending login details to an attacker. Six AI browsers and assistants were tricked, including OpenAI's ChatGPT Atlas, Perplexity's Comet, and Anthropic's Claude browser extension. These AI browsers, when in agent mode, can interact with websites you are signed into. The trick works because the AI agent cannot reliably distinguish between normal content and malicious commands disguised as game rules. This is called indirect prompt injection. The attack starts with a web page designed as a puzzle. Once the agent accepts "wrong" answers as correct, it follows game logic instead of safety protocols. It then retrieves user credentials, and none of the six agents flagged this as an issue. In a test, the agent pulled SSH login credentials from a victim's work GitHub repository and sent them to an attacker. While LayerX used a harmless file, this method could target other sensitive data like open tabs or signed-in accounts. LayerX reported the issue to vendors between October 2025 and January 2026. OpenAI fixed it in ChatGPT Atlas, but Perplexity.