New "BioShocking" Attack Exploits AI Browsers to Bypass Security Controls Security researchers at LayerX have uncovered a novel attack technique called "BioShocking", which manipulates AI-powered browsers into leaking sensitive data by altering their perception of reality. The method exploits how large language models (LLMs) enforce safety guardrails through contextual understanding allowing threat actors to trick AI agents into ignoring security restrictions. The attack draws inspiration from the BioShock video game, where characters are controlled via distorted perception. Similarly, BioShocking uses prompt injection and context manipulation to convince AI systems they are operating in a fictional or game-like environment where normal rules don’t apply. Once the AI accepts this false context, it may comply with malicious instructions, such as retrieving credentials or accessing secure systems. In a demonstration, researchers embedded a BioShock-themed puzzle in a webpage. The AI agent was first presented with a simple math question but rewarded for incorrect answers (e.g., "2 + 2 = 5"). Over time, the AI adapted to this altered logic. In the final stage, it was instructed to navigate to a private path unbeknownst to the AI, this redirected to a GitHub repository containing sensitive credentials, which were then extracted and shared without triggering security warnings. The attack was successfully tested against multiple AI-enabled browsing tools, including: - ChatGPT Atlas (OpenAI) – Fixed - Comet (Perplexity AI) – Closed/ignored - Claude Chrome Plugin (Anthropic) – Patch unsuccessful - Fellou, Genspark, Sigma Browser – No response The broad impact highlights a systemic weakness in how AI agents interpret context. Since LLMs treat context as truth, attackers can reshape their decision-making, turning trusted tools into vectors for data exfiltration. Researchers warn that real-world attacks could target email accounts, internal dashboards, or password managers accessible within a user’s session. To mitigate risks, vendors are advised to require explicit user confirmation before accessing sensitive data, detect unrealistic contexts, and restrict agent capabilities in authenticated sessions. The discovery underscores a critical shift in AI security, where attackers no longer need to break systems directly instead, they can reshape how AI perceives reality.