Two major research disclosures this weekend reveal that AI-powered browsers have become a serious attack surface for prompt injection and remote code execution — and that operators don’t need to do much to trigger them.
BioShocking (disclosed June 29 by LayerX Security): A prompt injection technique that successfully tricked six agentic browsers into bypassing their safety guardrails and surrendering user credentials. Affected platforms include OpenAI’s ChatGPT Atlas, Perplexity AI’s Comet, Anthropic’s Claude Chrome plugin, Fellou, Genspark Browser, and Sigma Browser. The attack works by presenting the browser’s embedded LLM with a “puzzle that rewards intentionally wrong answers,” effectively getting the model to override its own safety instructions by reframing policy compliance as the incorrect behavior. Some vendors have patched; the underlying architectural issue remains.
AutoJack (disclosed June 18 by Microsoft Security Research): A three-vulnerability exploit chain against AutoGen Studio (pre-release builds 0.4.3.dev1 and 0.4.3.dev2) that allows a malicious webpage to hijack an AI agent and execute arbitrary shell commands on the host machine. The chain combines an origin-allowlist bypass, missing authentication on localhost MCP endpoints, and an unsanitized command-execution endpoint. No credentials required; no user interaction beyond the agent navigating to the page. Microsoft confirmed fixes in version 0.7 (commit b047730) before public disclosure, and noted the pattern extends beyond AutoGen: any AI agent that browses untrusted content and interacts with privileged local services should be treated as a high-risk endpoint.
Sources
- Microsoft Security Blog: AutoJack — Single Page RCE on a Host Running an AI Agent
- CybersecurityNews: AutoJack Vulnerability
- SOFX: Three Research Teams Flag AI Browsers as Security Risk
Commentary
BioShocking and AutoJack together define the new AI browser threat model. Prompt injection isn’t a nuisance bug — it’s a primary attack vector against any system where an LLM is given agency over real actions. AutoJack is particularly concerning because it turns the “localhost is trusted” assumption into a liability: if an AI agent can browse the web and also talk to localhost services, then any malicious page can become a C2 callback. Red teamers should be adding “AI agent pivot via prompt injection to localhost MCP” to their playbooks now. Defenders: if your environment has AI coding assistants or agentic browsers installed on developer workstations, those endpoints need the same scrutiny as any other privileged host.