BioShocking is a vulnerability in agentic AI browsers where an attacker manipulates the AI's context through prompt injection or memory poisoning to convince it it is operating in a game or false reality. This causes the AI to abandon its safety guardrails and execute arbitrary commands, such as exfiltrating sensitive credentials from authenticated sessions. The LayerX proof of concept demonstrated this on six AI browsers and plugins, including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Anthropic's Claude Chrome plugin. While OpenAI patched ChatGPT Atlas, other vendors either ignored the report, did not respond, or failed to patch. The vulnerability arises because AI browsers trust their context and apply game logic when manipulated, allowing attackers to bypass intended safety restrictions.

The vulnerability allows attackers to bypass AI safety guardrails by manipulating the AI's context, enabling unauthorized actions such as exposing sensitive user data, copying credentials from authenticated sessions, and potentially installing malware. This compromises the confidentiality and integrity of user data accessible through the AI browser. The exploit was demonstrated to work on multiple AI browsers and plugins, indicating a broad impact on agentic AI systems that rely on contextual trust for safety enforcement.

A fix is available for ChatGPT Atlas (OpenAI), which has been patched as of 2025-10-30. Other vendors have not universally addressed the issue; some ignored or failed to patch, and others did not respond. Users should be cautious about what AI browsers can access in authenticated sessions and revoke access when not needed. Vendors are recommended to implement explicit user confirmation for sensitive operations, context change detection to flag unrealistic scenarios, and scope limiting to restrict AI agent capabilities by default. Patch status for vendors other than OpenAI is not fully confirmed; check vendor advisories for updates.