New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
If you can trick an AI browser into thinking you're playing a game, it will give you your login information. This is the discovery underpinning LayerX's BioShocking approach, which deceived six AI browsers and helpers into copying user credentials and transferring them to an attacker.
The ChatGPT Atlas from OpenAI, Comet from Perplexity, and the Claude browser plugin from Anthropic were among the targets.
A browser that can do more than merely view websites is called an AI browser. It can click, type, and reach into the websites you are already logged into if you switch it to agent mode. Access is both the issue and the entire point.
These agents' reading abilities make the deception effective. The page appears as a single text stream together with your personal instructions. Thi...