Summary
- Zenity demonstrated indirect prompt-injection attacks that redirected ChatGPT Atlas across authenticated browser sessions.
- OpenAI says it deployed an update earlier in 2026 to address the issue and strengthen Atlas protections.
- Atlas is scheduled to stop working on 9 August as OpenAI moves browser-agent capabilities into the ChatGPT app.
Security researchers have demonstrated how hostile web content could steer OpenAI’s ChatGPT Atlas browser into taking actions across authenticated services, exposing the tension between autonomous browser authority and the untrusted content an agent is expected to process.
Researchers at Zenity tested OpenAI‘s Atlas using indirect prompt injection placed in content encountered during otherwise ordinary browsing tasks.
In controlled demonstrations, the researchers induced the browser agent to move from malicious web content into an authenticated WhatsApp Web session and send messages. In a separate shopping test, Atlas modified an Amazon account and shopping flow before the researchers used Amazon’s Rufus assistant to complete a purchase.
Zenity’s work is proof-of-concept research, not evidence of a campaign exploiting Atlas users in the wild. The demonstrations also encountered hard security boundaries: the researchers said they could not directly bypass OpenAI’s final purchase control and instead reached the transaction through the separate Amazon assistant.
The distinction is useful because the attack did not depend on conventional native-code exploitation of the browser. It manipulated an agent whose intended capabilities already included reading web content, navigating between sites, and acting through sessions in which the user was authenticated.
OpenAI disputes the implication that the reported condition remained wholly unaddressed. The company has said it deployed an update earlier in 2026 to address the issue and strengthen protections in Atlas.
The product itself is also approaching retirement. OpenAI’s support material says Atlas is scheduled to stop working on 9 August as browser-based agentic functionality moves into the ChatGPT application. OpenAI says protections developed for Atlas extend to browser capabilities in the newer product.
That makes the research more useful as an architectural case than as a long-lived Atlas vulnerability story. Agentic browsers have to process arbitrary websites while simultaneously holding authority delegated by the user. Content that is data from the browser’s perspective can look like an instruction to the model controlling it.
Traditional web security depends heavily on explicit boundaries between origins, applications, and authenticated sessions. An agent changes the practical shape of those boundaries because it can legitimately move between them on a user’s behalf. The browser may therefore prevent one website from reading another site’s cookies directly while the agent itself is authorised to act in both services.
The security decision shifts towards what the agent is allowed to do, which actions require deterministic approval, how untrusted content is isolated from higher-level instructions, and whether an action remains inside the purpose the user originally authorised.
The separate ChatGPT workspace weakness examined in July involved a different technical path, but both cases place agent authority inside the identity architecture rather than treating the model as a passive interface.
That becomes more consequential in enterprise environments where browser sessions may expose corporate email, customer platforms, file stores, messaging applications, HR systems, and administrative consoles. Multifactor authentication may already have been completed before the agent acts, leaving the security decision with session authority and tool controls rather than the original login process.
Hard approvals can reduce that exposure, although excessive confirmation undermines the automation users adopt agents to provide. The design problem is therefore not resolved by asking for consent more frequently. Controls have to distinguish routine navigation from actions capable of moving money, exposing data, changing permissions, or communicating externally.
Atlas will soon disappear as a standalone product, but the underlying security problem is moving in the opposite direction. Browser and computer-use agents are becoming more capable, and the authority they inherit from authenticated sessions is increasingly part of the security boundary that application and identity teams have to account for.
