BioShocking: The Attack That Tricks AI Browsers Into Thinking Credential Theft Is Just Winning a Game
Security researchers at LayerX have found a way to convince agentic browsers that stealing your SSH credentials is just part of the fun. The attack, which they've named BioShocking after the video game series, exploits something fairly fundamental: these agents reason within whatever context you give them, and if you frame that context cleverly enough, safety logic goes straight out the window.
The attack works by presenting the AI browser with a web-based puzzle. The puzzle's rules establish, early on, that incorrect answers are fine and expected. The tested browsers, including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome, all adapted their behaviour accordingly. Once an agent has internalised that wrong moves are acceptable within this context, it stops applying normal judgment about what constitutes a harmful action.
From there, the manipulation escalates. The agent is directed to navigate to a URL and retrieve content from a textbox. In LayerX's demonstration, that URL redirected to the victim's employer's GitHub repository, where the agent cheerfully pulled out SSH login credentials and handed them over. In the test environment this was a controlled exercise. In the wild, it wouldn't be.
The real danger is scope. Once an agent is operating under game logic rather than safety logic, it can be pointed at anything accessible within that browser session: other open tabs, authenticated internal tools, private repositories. The agent doesn't register the credential grab as malicious. It registers it as winning.
LayerX puts it plainly: the root cause is that these agents act within a context, and that context can be tampered with. Convincing an agent it's playing a game is enough to make it apply entirely different rules to everything it subsequently does.
Fixes aren't complicated in principle. Vendors could require explicit user confirmation before sensitive operations, add context integrity checks, and restrict what agents can actually reach within a session. On the user side, auditing what your AI browser can access and revoking permissions when you're done is basic hygiene that most people aren't doing.
LayerX disclosed the findings to all six vendors. The responses varied considerably. OpenAI fixed it. Anthropic attempted a patch that didn't actually work. Perplexity AI ignored the report entirely. Fellou, Genspark, and Sigmabrowser OU said nothing at all.
Three out of six vendors either failing or not bothering to respond to a disclosed security vulnerability is, to put it mildly, not a great look for an industry asking us to hand our browser sessions over to autonomous agents.