OpenAI’s Atlas Browser Can Be Tricked Into Spamming WhatsApp Contacts, Researchers Say

OpenAI’s Atlas browser can be manipulated into sending unsolicited WhatsApp messages and, in some cases, preparing unauthorized Amazon purchases, according to security researchers who unveiled their findings at the Black Hat conference in Las Vegas on Wednesday. The demonstrations highlight how quickly AI-powered browsers can turn from productivity tools into attack surfaces when they are allowed to act across websites on a user’s behalf.

The research, presented by Zenity, adds to growing concern that AI web agents are still too easy to mislead with hidden instructions buried in webpages, documents, or other online content. In the company’s tests, attackers did not need to break into WhatsApp or Amazon directly; instead, they exploited the browser’s attempt to follow instructions and complete tasks for a signed-in user.

What the researchers found

Zenity says it identified roughly 20 vulnerabilities and bypasses across AI-enabled browsers and browser extensions made by several major tech companies, including Google, Anthropic, Microsoft, Perplexity, and OpenAI. The issues ranged from reading files stored on the local machine to extracting browsing history and taking over a password manager.

The highest-profile demonstration involved OpenAI’s Atlas browser, which the company plans to retire next week. Even with more safeguards than some rival tools, Atlas could still be coaxed into carrying out actions the user never explicitly approved, researchers said.

In one proof of concept, Zenity got the browser to visit a seemingly harmless newsletter sign-up page after the user clicked a link on X. Hidden on that page were instructions, written in Hebrew, that directed the AI agent to open the user’s WhatsApp Web session and send a message to every contact in the account.

In another demonstration, the same broad technique was used to target Amazon. The browser was nudged to add a shipping address to a signed-in account and place a tablet into the cart. The researchers said they were unable to push the process all the way to a final purchase, but they were able to reach the stage where Amazon’s Rufus shopping assistant was asked to complete the transaction.

Why AI browsers are so vulnerable

AI browsers are designed to do more than summarize pages. They can log into websites, click through forms, compare information across tabs, and sometimes take actions such as purchasing an item or sending a message. That convenience is exactly what makes them risky.

As soon as an AI system is asked to operate inside the open web, it is exposed to untrusted material. Any page, banner, form field, or embedded text can potentially hide instructions meant to confuse the model or redirect its behavior. Security researchers have long warned that this opens the door to prompt injection, a class of attack in which malicious content overrides or corrupts a model’s intended task.

OpenAI’s own security leadership described prompt injection last year as an unsolved problem. Zenity’s findings reinforce that warning. The researchers argue that old browser protections such as same-origin policy, which normally helps prevent one site from meddling with another, can be undermined when an AI agent is allowed to interpret content and carry out cross-site actions on the user’s behalf.

What is “intent collision”?

Intent collision is when an AI merges a user’s legitimate request with hostile instructions hidden on a webpage. In practice, the model may try to satisfy both the user and the attacker at once, treating the malicious directions as part of the task rather than as an intrusion.

Zenity says that is exactly what happened in its demonstrations. The browser believed it was helping with a legitimate sign-up or shopping flow, while the embedded page instructions quietly diverted it toward spam, account manipulation, or other undesired behavior.

“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” Zenity cofounder and CTO Michael Bargury said while presenting the work at Black Hat.

How did the WhatsApp attack work?

The WhatsApp demonstration relied on deception, not a flaw in WhatsApp itself. Zenity says it convinced Atlas to follow a link to a newsletter sign-up page that looked ordinary to the browser. Hidden inside the page was a second layer of instructions aimed at the AI agent rather than the human user.

Those instructions, written in Hebrew, told the browser to open the user’s signed-in WhatsApp Web session and send a message to every contact. By using a language and presentation that appeared less suspicious to some of the browser’s protections, the researchers say they were able to slip past OpenAI’s safety checks.

The effect, according to the researchers, was similar to a self-spreading message worm. Once the browser sent the text to one contact, that person could be drawn into the same scheme, expanding the blast radius beyond the original account holder.

Bargury said the browser would move through the contact list and deliver the same message to each person, effectively turning a personal account into a distribution tool for spam or phishing.

WhatsApp declined to comment on the findings.

How was Amazon targeted?

The Amazon test used a similar pattern: lure the browser with a fake newsletter flow, then plant instructions that steer the AI into doing something the user did not ask for. In this case, Zenity says the browser added a shipping address to a logged-in Amazon account and placed a tablet in the cart.

The researchers could not force the browser to complete the final purchase on its own, which suggests Amazon’s own protections and OpenAI’s guardrails still stopped the most sensitive step. But Zenity says it found a workaround by having the system ask Amazon’s Rufus assistant to complete the order.

According to the researchers, Rufus was not hacked directly. It simply received a request that appeared to come from the customer and complied.

Amazon did not respond to a request for comment.

What OpenAI says about Atlas

OpenAI says it addressed the issue earlier this year and added stronger protections to Atlas before the browser is deprecated on August 9. A spokesperson said those protections also apply to browser capabilities inside the newer ChatGPT app.

The company has repeatedly said it is studying prompt injection and has published research on the problem. Still, the Black Hat presentation underscores the gap between promising defensive claims and the messy reality of an agent that must read and act on the same untrusted web pages humans browse every day.

Zenity says Atlas was the hardest of the browsers it tested to exploit, precisely because it had more security boundaries in place than competitors. But, the researchers added, those boundaries could still be crossed with enough creativity and persistence.

What does this mean for AI browsers more broadly?

The broader message from the research is not limited to OpenAI. Zenity said it found similar weaknesses in tools from several major vendors, suggesting the problem is structural rather than tied to a single browser.

AI browsers and extensions are emerging in two main forms. One group is built around dedicated browsers that ship with an AI assistant baked in. The other adds AI-powered agents into mainstream browsers through extensions. In both cases, the core pitch is the same: let the software read, summarize, navigate, and sometimes act.

That “act” part is where risk multiplies. The more authority a browser agent has—logged-in sessions, shopping privileges, messaging access, password manager integration—the more damage a successful attack can do. A compromised agent does not just leak text; it can impersonate the user across services.

Common attack paths researchers are watching

• Prompt injection hidden in webpages or form fields
• Cross-tab manipulation that jumps between logged-in services
• Unauthorized messaging from accounts such as WhatsApp
• Shopping or purchasing actions on retail platforms
• Access to local files, browsing history, or password managers

Why security experts are worried now

The concern is not that every AI browser flaw will lead to a headline-grabbing breach. In many cases, criminals still have easier ways to steal credentials or trick users with ordinary phishing. But security specialists say agentic browsers expand the attack surface in dangerous ways because they combine web access, identity, and execution in one place.

That makes the browser more than a viewer. It becomes a delegated operator with enough trust to cross boundaries a normal website should never cross. Once that happens, defenders can no longer rely only on conventional browser rules or on the model’s best guess about whether a prompt is malicious.

Zenity argues that truly reliable defenses need deterministic controls—hard-coded limits that do not depend on an AI system deciding whether something looks suspicious. In the researchers’ view, safety should not rest mainly on whether another AI can detect an AI attack.

Bargury warned that if the browser is given too much freedom, attackers can hijack accounts, expose data, and move from one online service to another through the user’s own trusted session.

How big is the risk to regular users?

The risk varies depending on how much access a person grants the browser and how often they use it for sensitive tasks. Someone who only asks an AI browser to summarize articles faces a different exposure than a user who connects email, shopping accounts, password managers, and messaging apps.

Even so, the demonstrations matter because they show that the attack does not require a dramatic software bug in a specific service. A user can be tricked into visiting a page that looks harmless, while the browser quietly interprets hidden instructions that trigger actions elsewhere.

That means routine habits—clicking a link, opening a newsletter, asking a browser assistant to help with a purchase—can become the entry point for abuse if the agent has too much authority.

Practical lessons for enterprises and consumers

1. Limit which accounts an AI browser can access.
2. Avoid connecting password managers unless absolutely necessary.
3. Treat any web page with embedded instructions as potentially hostile.
4. Use manual approval for actions involving messages, purchases, or logins.
5. Assume multilingual or disguised text may be part of an attack.

What comes next for AI browser security?

The Black Hat disclosures are likely to intensify pressure on browser makers to rethink how much autonomy they give AI agents. If the most cautious implementations can still be steered into abuse, the next generation of products may need much stricter permission models, stronger isolation between tasks, and more transparent user confirmations before any sensitive action.

The bigger test for the industry is whether it can build agents that are useful without being too trusting. As long as an AI browser can read untrusted pages and take real-world actions, the tension between convenience and security will remain unresolved.

For now, Zenity’s findings serve as a warning that AI browsing is not just a productivity story. It is also a security story, and one that is moving faster than the defenses built to contain it.

Timeline of the Atlas findings

The takeaway from the research is blunt: the browser is becoming an agent, and agents can be manipulated. Until security tools can reliably separate legitimate instructions from hidden malicious ones, the safest assumption is that any AI browser with broad permissions can be turned against its user.