For lakhs of Indians, an unsolicited WhatsApp message from an unknown number has become part of everyday life, whether it is an advertisement, a sales pitch, or a promotional offer.
While the Meta-owned platform has rolled out several features to curb the menace, researchers warn that the next wave of spam delivered to your WhatsApp chat screen could be end-to-end automated by hijacking AI agents offered by leading AI companies such as OpenAI.
Researchers at cybersecurity firm Zenity have found that OpenAI’s Atlas web browser – that comes with a built-in AI agent – can be tricked into spamming dozens of WhatsApp contacts. The findings were published in a new research paper presented on Wednesday, August 5, at the Black Hat cybersecurity conference in Las Vegas, Nevada, United States.
Notably, the experiment involved bypassing multiple security mechanisms put in place by OpenAI. To be sure, the researchers did not exploit a vulnerability in WhatsApp and the messaging app’s end-to-end encryption feature was not compromised.
However, researchers found over 20 security flaws in AI-enabled web browsers and browser extensions rolled out by OpenAI, Google, Anthropic, Microsoft, and Perplexity. These flaws could be exploited to compromise the AI browser agents and use them to access local machines, download internal files, take over a password manager, and make unauthorised shopping purchases on Amazon.
The research lends weight to early warnings that autonomous AI agents embedded in web browsers and extensions could introduce new cybersecurity risks. It also highlights the need for new safeguards tailored specifically to AI browser agents. Long-standing web security practices such as the same-origin policy that stops websites interacting with each other, can be made effectively useless by AI browser agents, as per the researchers.
“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” Michael Bargury, cofounder and CTO of Zenity, was quoted as saying by Wired.
Story continues below this ad
“You are putting yourself in a situation where the browser can completely get hijacked and your accounts can get compromised, your data can leak. We should be very mindful about planning out what level of access the agents need to get to the browsers and what level of agency they need to use those browsers,” Bargury added.
While the researchers said that they reported the findings to OpenAI in January 2026, the AI startup said that prompt-injection attacks are something OpenAI is actively researching and has published multiple pieces of research on it. “Earlier this year, we deployed an update to address the issue and strengthen protections in Atlas, which will be deprecated on August 9. These protections extend to the browser capabilities in the new ChatGPT app,” an OpenAI spokesperson was quoted as saying.
What are AI browser agents?
AI has entered web browsing in two key ways: dedicated browsers with an AI agent at the centre and extensions that integrate AI agents into existing browsers. AI browser agents can be used to navigate websites, summarise web pages, and undertake other such browsing actions autonomously on behalf of the user.
However, AI browser agents are particularly susceptible to direct or indirect prompt injection attacks because they constantly interact with untrusted web content that may contain malicious instructions, which can be interpreted as legitimate user commands and executed by the agents.
Story continues below this ad
Out of all the AI browser tools probed by the researchers, they found that OpenAI’s Atlas had the most protections and security boundaries in place. But researchers were still able to bypass these measures and take control of Atlas. Other AI browser tools were even more easier to compromise, as per the researchers.
How was Atlas used to spam WhatsApp users?
As part of its proof-of-concept attack, Zenity researchers went about carrying out a mass phishing campaign. First, they instructed ChatGPT Atlas to sign up to a newsletter on their behalf by clicking on a link they had posted on X.
The webpage containing the sign-up process for the newsletter had hidden, malicious instructions telling the Atlas web browser agent to navigate to the user’s signed-in WhatsApp web account and send every contact the same message.
The agent then proceeded to go through each and every one of the contacts and send them instructions to sign up for this newsletter as well. It was a worm-like attack that spread from one victim to their friends and family.
Story continues below this ad
In order to get past the in-built Atlas safety measures, the researchers wrote the malicious instructions in Hebrew as they knew that the security tools only supported English. The researchers also merged legitimate instructions from a user and malicious instructions from the web in order to achieve their goal. This type of incident is known as an ‘intent collision’ attack.
Furthermore, they falsely told the agent that it was using a sandboxed version of WhatsApp web with fake users.
In a similar experiment with Amazon, the researchers made Atlas add a shipping address to a logged-in Amazon account and add a tablet to the shopping cart. But when they tried to make the AI browser agent purchase the item, they were blocked by OpenAI’s safety measures.
Then, the researchers got Atlas to ask Amazon’s Rufus AI shopping assistant to make the purchase for them. Surprisingly, Rufus readily complied with the instructions without needing to be hijacked or injected with malicious prompts.
Story continues below this ad
In order to prevent real-world hackers from hijacking AI browser agents, the researchers recommended developing “deterministic” or hard security barriers that are not just AI-powered classifiers.
Why is OpenAI shutting down Atlas?
Last month, OpenAI announced that it is pulling the plug on its first-ever AI browser. In place of Atlas, the company said it is rolling out a new ChatGPT extension for Chrome and updating the ChatGPT desktop app with more advanced browsing capabilities.
Atlas made its debut in October 2025 as OpenAI’s answer to the intensifying race among tech companies to reinvent web browsers with AI agents.
The past year has seen several companies attempt to challenge Google Chrome’s dominance. Perplexity launched its AI browser, Comet; The Browser Company introduced Dia; and both Google and Microsoft expanded AI capabilities in Chrome and Edge, respectively.
Story continues below this ad
However, the adoption of AI browser agents has struggled to meet the industry’s expectations. One of the reasons why these types of AI agents have failed to take off is because of their massive computational requirements. AI browser agents work by taking a series of screenshots of a webpage, feeding that into an AI model, and taking actions based on what they see. Processing such a large volume of information can take time and may not always lead to accurate actions.
