The 'BioShocking' attack manipulates agentic AI browsers by convincing them they are playing a game, causing them to apply game logic instead of real-world safety logic. This context manipulation leads the AI browsers to perform malicious actions such as navigating to URLs containing sensitive information and exfiltrating credentials. The attack was demonstrated on several AI browsers including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome. The root cause is the browsers' reliance on contextual understanding that can be manipulated, allowing them to bypass safety guardrails. Vendors can mitigate this by requiring confirmation for sensitive operations, performing context checks, and limiting agent action scope. OpenAI patched the vulnerability, Anthropic's patch failed, and other vendors either ignored or did not respond to the report.

The vulnerability allows an attacker to manipulate AI browsers into exfiltrating sensitive credentials and potentially accessing authenticated repositories or internal tools without the AI recognizing the action as malicious. This could lead to unauthorized disclosure of sensitive information. The impact is limited to AI browsers that do not adequately verify context or confirm sensitive operations. No known exploits in the wild have been reported. The issue has been patched by OpenAI but remains unpatched or unaddressed by some other vendors.

OpenAI has released a patch addressing this vulnerability. Users and vendors should ensure AI browsers request explicit confirmation before performing sensitive operations, implement context validation to detect manipulation, and restrict the scope of AI agent actions. Users should monitor and control what AI browsers can access during sessions and revoke permissions when sessions end. For vendors who have not patched, it is critical to apply fixes or implement mitigations as recommended by LayerX. Check vendor advisories for the latest remediation status.