Even as OpenAI works to harden its Atlas AI browser against cyberattacks, the company admits that prompt injections, a type of attack that manipulates AI agents to follow malicious instructions often hidden in web pages or emails, is a risk thatโs not going away anytime soon โ raising questions about how safely AI agents can operate on the open web.ย
โPrompt injection, much like scams and social engineering on the web, is unlikely to ever be fully โsolved,โโ OpenAI wrote in a Monday blog post detailing how the firm is beefing up Atlasโ armor to combat the unceasing attacks. The company conceded that โagent modeโ in ChatGPT Atlas โexpands the security threat surface.โ
OpenAI launched its ChatGPT Atlas browser in October, and security researchers rushed to publish their demos, showing it was possible to write a few words in Google Docs that were capable of changing the underlying browserโs behavior. That same day, Brave published a blog post explaining that indirect prompt injection is a systematic challenge for AI-powered browsers, including Perplexityโs Comet.ย
OpenAI isnโt alone in recognizing that prompt-based injections arenโt going away. The U.K.โs National Cyber Security Centre earlier this month warned that prompt injection attacks against generative AI applications โmay never be totally mitigated,โ putting websites at risk of falling victim to data breaches. The U.K. government agency advised cyber professionals to reduce the risk and impact of prompt injections, rather than think the attacks can be โstopped.โย
For OpenAIโs part, the company said: โWe view prompt injection as a long-term AI security challenge, and weโll need to continuously strengthen our defenses against it.โ
The companyโs answer to this Sisyphean task? A proactive, rapid-response cycle that the firm says is showing early promise in helping discover novel attack strategies internally before they are exploited โin the wild.โย
Thatโs not entirely different from what rivals like Anthropic and Google have been saying: that to fight against the persistent risk of prompt-based attacks, defenses must be layered and continuously stress-tested. Googleโs recent work, for example, focuses on architectural and policy-level controls for agentic systems.
But where OpenAI is taking a different tact is with its โLLM-based automated attacker.โ This attacker is basically a bot that OpenAI trained, using reinforcement learning, to play the role of a hacker that looks for ways to sneak malicious instructions to an AI agent.
The bot can test the attack in simulation before using it for real, and the simulator shows how the target AI would think and what actions it would take if it saw the attack. The bot can then study that response, tweak the attack, and try again and again. That insight into the target AIโs internal reasoning is something outsiders donโt have access to, so, in theory, OpenAIโs bot should be able to find flaws faster than a real-world attacker would.ย
Itโs a common tactic in AI safety testing: build an agent to find the edge cases and test against them rapidly in simulation.ย
โOur [reinforcement learning]-trained attacker can steer an agent into executing sophisticated, long-horizon harmful workflows that unfold over tens (or even hundreds) of steps,โ wrote OpenAI. โWe also observed novel attack strategies that did not appear in our human red teaming campaign or external reports.โ
In a demo (pictured in part above), OpenAI showed how its automated attacker slipped a malicious email into a userโs inbox. When the AI agent later scanned the inbox, it followed the hidden instructions in the email and sent a resignation message instead of drafting an out-of-office reply. But following the security update, โagent modeโ was able to successfully detect the prompt injection attempt and flag it to the user, according to the company.ย
The company says that while prompt injection is hard to secure against in a foolproof way, itโs leaning on large-scale testing and faster patch cycles to harden its systems before they show up in real-world attacks.ย
An OpenAI spokesperson declined to share whether the update to Atlasโ security has resulted in a measurable reduction in successful injections, but says the firm has been working with third parties to harden Atlas against prompt injection since before launch.
Rami McCarthy, principal security researcher at cybersecurity firm Wiz, says that reinforcement learning is one way to continuously adapt to attacker behavior, but itโs only part of the picture.ย
โA useful way to reason about risk in AI systems is autonomy multiplied by access,โ McCarthy told TechCrunch.
โAgentic browsers tend to sit in a challenging part of that space: moderate autonomy combined with very high access,โ said McCarthy. โMany current recommendations reflect that trade-off. Limiting logged-in access primarily reduces exposure, while requiring review of confirmation requests constrains autonomy.โ
Those are two of OpenAIโs recommendations for users to reduce their own risk, and a spokesperson said Atlas is also trained to get user confirmation before sending messages or making payments. OpenAI also suggests that users give agents specific instructions, rather than providing them access to your inbox and telling them to โtake whatever action is needed.โย
โWide latitude makes it easier for hidden or malicious content to influence the agent, even when safeguards are in place,โ per OpenAI.
While OpenAI says protecting Atlas users against prompt injections is a top priority, McCarthy invites some skepticism as to the return on investment for risk-prone browsers.ย
โFor most everyday use cases, agentic browsers donโt yet deliver enough value to justify their current risk profile,โ McCarthy told TechCrunch. โThe risk is high given their access to sensitive data like email and payment information, even though that access is also what makes them powerful. That balance will evolve, but today the trade-offs are still very real.โ
