Breaking

'BioShocking' Attack Fools AI Browsers via Game, Steals SSH Keys Across 6 Products

July 1, 2026 at 13:06 EDT

Security
AI Agents

Researchers at security firm LayerX have demonstrated a new attack called "BioShocking" that gets AI agentic browsers to read a malicious web page as a "puzzle game," bypassing safety guardrails to steal SSH credentials from authenticated sessions. They report successful proof-of-concept exploits across six products, including ChatGPT Atlas and Perplexity Comet.

Agentic Browser Security · LayerX Disclosure

"BioShocking" — a text-only puzzle that hijacks AI browsers into leaking your credentials

A malicious page disguised as a puzzle game convinces an AI agent that "wrong answers win" — collapsing its guardrails and tricking it into exfiltrating GitHub SSH credentials from a signed-in session. No exploit, no code execution, no user click.

6 / 6

AI browsers tested were successfully compromised

browser exploits or user clicks required — plain text only

of 6 vendors confirmed a working fix (OpenAI)

Vendor response: one fix, five gaps

Reported to vendors from ~October 2025 — a fix was confirmed for only one product.

Fix
implemented

Ineffective,
closed, or silent

How the guardrail collapses

Indirect prompt injection + context manipulation — named after BioShock's "Would you kindly?"

1 · LURE

A text-only "puzzle game" where wrong answers win.

→

2 · MERGE

Agent reads page + rules as one text stream; safety becomes part of the game.

→

3 · EXFIL

Agent sends GitHub SSH creds out — while celebrating it "won the game."

Where each product stands

ChatGPT Atlas · OpenAI

Fix implemented

Claude Chrome plugin · Anthropic

Patch ineffective vs PoC

Comet · Perplexity

Report closed, no action

Fellou · Genspark · Sigma

No response / unaddressed

An AI browser's strength — accessing logged-in sessions — is exactly its risk. A structural weakness shared with AutoJack and PleaseFix.

Countermeasure: minimize access to authenticated sessions when running agent mode.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.