Researchers Expose Critical Security Flaws in AI-Powered Web Browsers

Researchers at security firm Zenity have uncovered significant vulnerabilities in AI-assisted web browsers that could allow attackers to manipulate these tools into compromising user accounts and spreading malware. The findings, presented at the Black Hat security conference in Las Vegas, reveal systemic security gaps across products from OpenAI, Google, Anthropic, Microsoft, and Perplexity.

The Scope of the Problem#

Zenity's investigation uncovered approximately 20 distinct security flaws across AI-enabled browsers and extensions. These vulnerabilities enable attackers to access local machines, steal files, compromise password managers, and expose complete browsing histories. Michael Bargury, Zenity's cofounder and CTO, characterized the situation as a regression to cybersecurity practices of two decades past: "They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago."

How AI Browsers Create New Attack Vectors#

Modern AI-powered browsing tools operate in two primary configurations: dedicated browsers with built-in AI assistants and extensions layered onto existing browsers. These systems can autonomously navigate websites, summarize content, and execute actions across multiple tabs on behalf of users. This autonomous capability introduces a fundamental security challenge—when AI agents process information from the untrusted web environment, they can be manipulated through prompt injection attacks, where malicious instructions embedded in web content override legitimate user commands.

Proof-of-Concept Attacks#

The researchers demonstrated their findings with two practical attacks against OpenAI's Atlas browser (now being phased out). In the first scenario, they crafted a fake newsletter signup page containing Hebrew-language instructions directing Atlas to access WhatsApp Web and send promotional messages to every contact in the user's account. By using a non-English language and making the page appear legitimate, the researchers bypassed OpenAI's safety mechanisms. Bargury describes the attack as creating a self-propagating worm: contacts receiving the message would be tricked into visiting the malicious page, spreading the compromise further.

In a second demonstration, the team used similar tactics to add a shipping address and product to a logged-in Amazon account. While they encountered stronger protections preventing direct purchase completion, they successfully instructed Amazon's Rufus AI shopping assistant to complete the transaction, which complied without recognizing it was being exploited.