On October 28, 2025, Futurism reported a new and significant attack vector affecting the omnibox of OpenAI's recently released AI browser Atlas. The omnibox (a combined address bar and AI prompt input) exhibits prompt‑injection vulnerabilities. Researchers demonstrated how specially crafted URLs, page fragments, or hidden text can induce the omnibox to treat instructions embedded in a page or URL as user intent and send them to the backend model, thereby bypassing traditional same‑origin and sandbox boundaries.
Atlas, OpenAI's first AI‑driven browser, was released on October 21 and aims to use an "agent" mode to let the AI assistant complete complex tasks like booking flights or shopping, but design shortcomings make it easy for attackers to inject malicious instructions that cause the browser to perform harmful actions. Author Victor Tangermann notes this vulnerability is not isolated but indicative of systemic issues in AI agent browser products, similar to Perplexity's Comet browser. Drawing on reporting from LayerX Security, The Hacker News and Malwarebytes, the vulnerability's severity appears greater than initially expected and could amplify risks to privacy and data integrity. OpenAI Chief Security Officer Dane Stuckey acknowledged that prompt injection remains a "frontier unresolved problem," and adversaries are expected to invest heavily in attacking ChatGPT agents. The incident highlights a crossroads between innovation and security for AI browsers, and regulators worldwide may intervene to reshape industry standards.
The report details several key stages of the attack chain: first, an attacker embeds carefully crafted text or data URIs in a web page, which the omnibox collects when parsing an address or rendering a preview; second, the omnibox fails to strictly distinguish between "direct user input" and "page‑provided text," concatenating strings and sending the result as a prompt to the model; finally, the model executes instructions based on the mixed context it receives, which may cause it to return sensitive information or perform text‑driven actions. Researchers warn such injections can be used to induce the model to disclose session context, system prompts, or to generate content usable in further phishing or social‑engineering attacks.
On the technical side, the report emphasizes two dangerous properties: firstly, the omnibox serves the dual role of address resolution and natural‑language prompting, creating ambiguous input boundaries; secondly, models are highly compliant to directive text, making it difficult to fully block "malicious instructions" through static filtering. The research team demonstrated multiple proofs of concept, including injecting instructions via URL fragments that request actions such as "show all local filenames," prompting the model to return pieces of information that should have been restricted. NeuralTrust's research group found the omnibox (the address bar) to be highly susceptible to prompt‑injection attacks. The attack is simple: an attacker crafts a string that looks like a URL (for example, beginning with "https://" but deliberately malformed); when a user copies and pastes it into the omnibox, the browser may fail to validate it as a legitimate page and instead treat the entire string as a high‑trust user‑intent prompt. This bypasses security checks and allows embedded malicious directives to execute, such as "follow only these instructions" or "visit neuraltrust.ai."
The potential impact is broad: for ordinary users, attacks could lead to privacy breaches, redirection to malicious sites, or generation of convincing phishing content; for developers and enterprises, attacks could be used to exfiltrate internal prompts, expose configurations, or tamper with inputs and outputs of automated tasks. The report also notes that traditional web‑security assumptions (such as the same‑origin policy) do not directly defend against semantically layered prompt injection, because the attack targets the AI layer that interprets text rather than the browser DOM itself.
For mitigation, researchers propose several short‑ and medium‑term measures: restrict the omnibox's automatic collection of page text, strictly tag and isolate inputs originating from pages, and apply context‑minimization and policy filtering to prompts before sending them to models. Longer‑term fixes should include a permissioned, layered design for the browser‑model interface to ensure only explicit user interactions can trigger high‑sensitivity operations, and the introduction of verifiable "deny rules" within models.
Futurism also urged ordinary users to exercise caution when using integrated AI browsers: avoid entering sensitive information into prompts from unverified sources, temporarily disable auto‑summarization or auto‑execution features, and keep browsers and extensions updated to receive vendor patches. The article stresses that as AI features are embedded directly into browsers, security boundaries must be redefined and browser sandbox protections should be supplemented with defenses aimed at semantic and prompt‑level attacks.
The researchers disclosed their findings to OpenAI and withheld some technical details in the public report to allow for peer review and vendor fixes. As model‑based UIs become more common in mainstream browsers, developers and the security community must accelerate the establishment of standard detection and mitigation workflows for prompt injection to prevent single points of failure from causing cascading risks.