BioShocking Hack Steals Credentials from 6 AI Browsers
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- LayerX disclosed a technique called BioShocking that exploited indirect prompt injection across six AI browsers and assistants, slipping commands into web pages disguised as game content that the agents could not distinguish from user instructions.
- The attack used a puzzle rewarding wrong answers (insisting 2+2=5), causing agents to follow "game logic instead of safety logic," and not one of the six targets flagged the final step — copying user credentials — as something to refuse.
- In LayerX's test, a link to the victim's GitHub repository prompted the agent to pull SSH login credentials and pass them to the attacker, with LayerX noting the same technique could reach open tabs, signed-in accounts, and internal tools in the same session.
- Vendor responses were uneven after LayerX reported the issues between October 2025 and January 2026: OpenAI fixed ChatGPT Atlas, Perplexity closed the report without acting, Anthropic's patch for its Claude extension "did not hold" per LayerX, and Fellou, Genspark, and Sigma did not respond.
- LayerX recommends AI browsers prompt before reading from logged-in accounts (e.g., "I'm about to copy data from your GitHub repository. Continue?") and let users set hard limits on what an agent can access in a session.
- The attack's name nods to BioShock's trigger phrase "Would you kindly?" — the researcher analogy being that agents trust whatever context they are handed, so changing the context changes what they will do.
Why it matters: An AI browser in agent mode is effectively a trusted account with reach into company systems, so a successful jailbreak becomes credential theft against signed-in services rather than a parlor trick. With Perplexity closing the report without acting and Anthropic's patch reportedly failing, enterprise users running these agents against GitHub or internal tools are exposed to credential exfiltration that the agent performs willingly and cheerfully.
