- Published on
OpenAI’s Browser Could Be Hijacked to Spam Your WhatsApp Contacts
- Authors
- Name
- DeepHorus
Researchers at Black Hat in Las Vegas presented findings today showing that OpenAI’s Atlas browser could be tricked into spamming WhatsApp contacts and adding items to an Amazon cart. The findings come from security firm Zenity, which probed AI browsers and extensions from Google, Anthropic, Microsoft, and Perplexity. Around 20 flaws were found, including access to local files, password managers, and entire browsing histories.
Zenity demonstrated the attacks as AI assistants become common in web browsing. These agents can summarize pages and take actions across multiple tabs, but they rely on untrusted web data. That opens the door to prompt-injection attacks, where hidden instructions manipulate the AI. Standard protections like same-origin policy can become “effectively useless,” the researchers said.
OpenAI’s Atlas, shutting down next week, had the strongest security boundaries among tested products. Still, Zenity bypassed them. In one test, a fake newsletter sign-up page on X contained Hebrew instructions. Atlas then opened the user’s WhatsApp Web account and sent a phishing message to every contact, turning it into a worm.
The attack did not exploit a WhatsApp vulnerability. Instead, it merged malicious web instructions with the user’s legitimate request — what Zenity calls an “intent collision.” A similar Amazon test added a shipping address and a tablet to the cart, though the purchase could not be completed.
Zenity’s CTO, Michael Bargury, said browser security controls have been “nerfed,” bringing back attacks from 20 years ago. He warned that the WhatsApp worm could infect friends and family. WhatsApp declined to comment on the findings.
The findings highlight growing worries about AI agents in browsers. OpenAI’s security chief previously called prompt injection an “unsolved security problem.” As companies race to add assistants, researchers say more flaws are likely to emerge, and new defenses will be necessary.
