Security researchers find ChatGPT Atlas browser vulnerable to prompt injection days after launch

Days after OpenAI launched the Atlas browser, security researchers at NeuralTrust disclosed a prompt-injection flaw in its “omnibox,” the combined address and search bar. The omnibox decides whether typed input is a URL or a natural-language command to the AI agent; NeuralTrust found that a deliberately malformed string beginning with “https://” and containing domain-like text, followed by additional text, would fail URL validation and instead be interpreted as an instruction. An attacker could use this to redirect a user to a phishing site or trigger unwanted actions in connected apps, without the user knowingly typing a command at all.

OpenAI’s chief information security officer acknowledged the class of problem directly, calling prompt injection — where attackers hide malicious instructions in websites, emails or other content to manipulate an AI agent — a “frontier, unsolved security problem,” while saying OpenAI had red-teamed Atlas and built in safeguards. The company did not claim the vulnerability was closed, only that it was an area of active mitigation.

The disclosure was one of the first concrete demonstrations of a risk that security researchers had been warning about since AI browsers and browser-agent products began shipping in 2025: that giving a language model the ability to act on a page it is reading creates an attack surface with no clean analogue in earlier browser security, since the model cannot reliably distinguish content from instructions. Similar injection weaknesses were later reported in other AI browsers, including Perplexity’s Comet, reinforcing that the problem was structural to the category rather than a bug specific to one product.