Security firm Zenity disclosed around 20 flaws in AI-enabled web browsers at Black Hat in Las Vegas on August 5, 2026, including a chain of exploits that turns OpenAI's Atlas browser into a WhatsApp phishing worm and tricks Amazon's Rufus assistant into making an unauthorized purchase. The findings span products from OpenAI, Google, Anthropic, Microsoft, and Perplexity, and demonstrate that the security perimeter around agentic browsing is thinner than any of the vendors have advertised.
Zenity researchers were able to access local machines, grab files, take over a password manager, and exfiltrate an entire browsing history across the tools they probed. Michael Bargury, Zenity's cofounder and CTO, framed the regression bluntly, comparing the current threat surface to browser attacks from two decades ago.
“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago.”— Michael Bargury, Cofounder and CTO of Zenity
OpenAI's Atlas — which the company is deprecating on August 9 — had the strongest guardrails of any AI browser Zenity tested, according to Bargury. The team still bypassed them. Other tools in the study were substantially easier to hijack, though Zenity's public write-up focuses on Atlas because breaking the best-defended target is the more interesting result.
Key facts
- 01Zenity researchers found around 20 flaws across AI browsers from OpenAI, Google, Anthropic, Microsoft, and Perplexity, disclosed at Black Hat in Las Vegas on August 5, 2026.
- 02A proof-of-concept turned OpenAI's Atlas into a WhatsApp phishing worm by embedding Hebrew-language instructions on a newsletter sign-up page.
- 03Researchers tricked Amazon's Rufus shopping assistant into completing an unauthorized purchase after Atlas' own safety layer blocked the checkout.
- 04Zenity reported the findings to OpenAI in January; OpenAI patched Atlas and will deprecate the browser on August 9.
- 05Atlas had the most protections of any AI browser tested, but Zenity still bypassed them via what it calls 'intent collision.'
The WhatsApp attack begins with an Atlas user clicking a newsletter sign-up link posted to X. The landing page contains hidden instructions written in Hebrew that tell the agent to navigate to the user's signed-in WhatsApp web session and message every contact the same newsletter link. The researchers describe it as a mass phishing campaign that does not exploit any vulnerability in WhatsApp itself — the trust boundary that fails is inside the browser agent.
The attack chains around multiple OpenAI safety layers: the sign-up page is designed to look benign, the Hebrew payload evades English-language content classifiers, and the malicious prompt falsely claims the WhatsApp session is a sandbox populated by fake contacts. Because the agent merges the user's stated intent with attacker-supplied instructions from the page, it treats the phishing campaign as an extension of the user's own request. Zenity calls this pattern 'intent collision.'
“What it'll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm.”— Michael Bargury, Cofounder and CTO of Zenity
The Amazon proof-of-concept used the same newsletter-page delivery vector. Atlas added a shipping address to a logged-in Amazon account and dropped a tablet in the cart, but OpenAI's checkout safeguards blocked the purchase itself. So the researchers had Atlas ask Amazon's Rufus shopping assistant to complete the transaction — and Rufus complied. As Zenity wrote in its blog post, Rufus was not hijacked or injected; it was simply asked by what it took to be the customer.
That handoff is the more unsettling finding. Two independently deployed AI agents, each with its own safety posture, produced an outcome neither was individually authorized to perform. The attack surface is no longer a single model or a single browser — it is the composition of agents that trust each other's requests. WhatsApp declined to comment on the findings. Amazon did not respond to a request for comment.
“Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9.”— OpenAI spokesperson, OpenAI
Zenity reported the vulnerabilities to OpenAI in January. An OpenAI spokesperson said the company shipped an update to Atlas earlier this year and that the same protections extend to the browser capabilities in the new ChatGPT app. OpenAI has published multiple pieces of research on prompt injection, which the company's security chief last year called an unsolved problem. That framing has not changed.
The researchers' prescription is architectural rather than incremental. Zenity argues that AI browsers need deterministic, hard-coded security barriers around sensitive actions — sending messages, moving money, exfiltrating files — rather than relying on the model's own judgment to refuse. Model-based classifiers can nearly always be fooled, particularly by attackers who can iterate against them; a hard barrier that requires an out-of-band confirmation cannot.
The counterweight worth stating: real-world attackers have easier paths than a Hebrew-language prompt-injection worm. Direct phishing and credential theft still dominate, and the Atlas exploit chain required a user to click a malicious link and grant an agent broad browsing authority. But the trajectory matters more than any single proof-of-concept. Every major lab is racing to ship agents with more autonomy, more account access, and more cross-service reach, and the security research community keeps finding that the guardrails are model outputs rather than enforced controls.
Zenity's disclosure lands in a week when agentic browsing is the industry's most-marketed capability and its least-tested one. The commercial pressure to ship agents that can act across a user's logged-in sessions runs directly against the security principle that a compromised page should not be able to weaponize a signed-in account. Until vendors are willing to constrain what agents can do without an explicit human confirmation — not a model-graded one — the WhatsApp worm and the Rufus handoff are templates, not curiosities. Atlas is being retired next week, but the design pattern it embodied is now standard across the category.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
