Researchers Hijack OpenAI's Atlas Browser Into Spamming WhatsApp Contacts, Attempting Amazon Purchase

AI browsers were supposed to make the internet easier to use. Researchers at Black Hat just showed how easily they turn against the people using them.

Security firm Zenity presented findings this week showing OpenAI's Atlas browser could be manipulated into sending unsolicited messages to every contact in a user's WhatsApp Web account, and separately coaxed into adding a tablet to a shopping cart on a signed-in Amazon account, according to Wired and Superintelligence News. Zenity said it did not push the Amazon attack all the way to a completed purchase, but it did get far enough that Amazon's Rufus shopping assistant was asked to finish the transaction.

Zenity cofounder and CTO Michael Bargury, who presented the research alongside colleague Stav Cohen, said the flaws represent a step backward for browser security. "They have nerfed the security control of browsers, we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago," Bargury told Wired.

How the attack worked

In the WhatsApp demonstration, researchers posted a link on X pointing to what looked like an ordinary newsletter sign-up page. Buried in that page were instructions written in Hebrew, invisible to a casual human reader but readable by the AI agent, directing Atlas to open the user's signed-in WhatsApp Web session and blast the same message to every contact in the account. Zenity describes it as a functional mass phishing campaign. Critically, the attack did not exploit any flaw in WhatsApp itself. It exploited Atlas's willingness to follow text it found on a webpage as if it were a legitimate command from the user.

The Amazon version worked the same way: hidden instructions nudged the browser to add a shipping address and place an item in the cart on a signed-in account, according to Superintelligence News.

Not just an OpenAI problem

Zenity said it found roughly 20 vulnerabilities and bypasses spanning AI-enabled browsers and browser extensions from Google, Anthropic, Microsoft, Perplexity, and OpenAI. The flaws ranged from reading files off a user's local machine to extracting full browsing history and taking over a password manager.

Notably, Bargury told Wired that Atlas actually had the most security protections of any tool they tested. The researchers still found ways around them. Other companies' AI browsing products, he said, were "much easier to hack." That is not a defense of OpenAI so much as an indictment of the entire category.

The root cause is not new, and not solved

None of this is a shock to anyone who has followed prompt injection since AI agents started browsing the web on users' behalf. OpenAI's own security chief called prompt injection an "unsolved security problem" last year, a characterization Wired's reporting reiterates. The core issue is architectural: once an AI agent is instructed to read and act on whatever content it encounters on the open web, it has no reliable way to distinguish a legitimate instruction from the user and a malicious one hidden in a webpage, document, or ad banner. Longstanding browser protections like same-origin policy, built specifically to stop one website from meddling with another, become largely irrelevant when an AI agent is the one crossing those boundaries on the user's authority.

That is a fair and serious concern, and it is not coming from technophobes. It is coming from the security researchers building proof-of-concept attacks and from OpenAI's own stated position that the problem remains unresolved.

What OpenAI is actually doing

OpenAI is shutting down Atlas on August 9, according to Superintelligence News, which reported the company said it had already fixed the specific issues Zenity found earlier this year. Wired's report frames the shutdown as separate from the vulnerability disclosure and does not attribute the retirement directly to Zenity's findings. To be precise: Atlas is being deprecated as a product decision, not pulled overnight in response to this research, and no user complaints, breach reports, or financial losses tied to these specific exploits have been reported by either outlet.

Ground News's aggregation of coverage on this story flagged that sourcing on this topic skews heavily toward left-leaning outlets, with no tracked center or right-leaning coverage in its sample. That is a gap worth naming. This is a technical security story, not a partisan one, and the imbalance says more about which outlets have cybersecurity desks aggressively covering Black Hat than about any political angle to the vulnerability itself.

What's unresolved

Neither Google, Anthropic, Microsoft, nor Perplexity has issued a public, detailed response to Zenity's specific findings for their own tools, based on available reporting. Zenity has not published a full technical writeup of all 20 vulnerabilities, and it remains unclear how many of the affected companies have patched the exact bypasses demonstrated at Black Hat. The bigger question is whether "fix the specific exploit" is even possible at scale, or whether letting AI agents act autonomously across the open web is a design choice the industry needs to rethink before rolling these tools out further.