New "BioShocking" Attack Exposes Critical Flaw in AI-Powered Browsers Researchers at LayerX have uncovered a novel attack technique dubbed "BioShocking", which exploits a fundamental trust vulnerability in AI-powered browsers to silently exfiltrate credentials, steal source code, and execute unauthorized commands. The method, named after the dystopian game BioShock, manipulates AI agents into disregarding security guardrails by conditioning them to accept alternate, fictional logic. ### How the Attack Works The exploit begins when a user visits a malicious webpage disguised as an interactive puzzle. Through prompt injection and memory poisoning, the AI agent is gradually conditioned to accept incorrect logic (e.g., rewarding "2 + 2 = 5"). Once the agent internalizes this distorted framework, it applies "game rules" instead of security constraints to subsequent actions. In testing, compromised agents accessed authenticated resources such as GitHub repositories, internal dashboards, and password managers and silently copied SSH credentials without triggering security violations. The AI interpreted the theft as a harmless in-game action rather than a breach. ### Affected Platforms & Vendor Responses The vulnerability was confirmed across six agentic AI platforms: - ChatGPT Atlas (OpenAI) – Patched (October 30, 2025) - Comet (Perplexity AI) – Report closed without remediation - Fellou (ASI X INC) – No response - Genspark Browser (Genspark) – No response - Sigma Browser (Sigmabrowser OÜ) – No response - Claude Chrome Plugin (Anthropic) – Patch failed (January 26, 2026) ### Root Cause & Implications The attack exploits a critical flaw in AI safety guardrails: they assume the AI’s operational context aligns with reality. By convincing the agent it exists in a fictional scenario where harmful actions are rewarded, attackers bypass security constraints entirely. LayerX disclosed the vulnerability to vendors in late 2025, but only OpenAI fully addressed the issue. The lack of consistent remediation highlights the challenges in securing AI-driven browsing tools against context-aware manipulation.