BioShocking Tricks AI Browsers into Exposing Credentials

Security firm LayerX published research on June 29, 2026 describing a technique it calls BioShocking: a malicious webpage frames a task as a puzzle, first getting the AI agent to accept a false premise (for example, that 2+2 equals 5 within the "game"), then presenting a follow-up instruction to find and copy a "hidden code" from another open page. The code is actually sensitive data, such as saved passwords, session cookies, or private tokens, which the agent copies and sends to the attacker as though completing the game. LayerX tested the proof-of-concept against six tools, ChatGPT Atlas, Perplexity's Comet, Fellou, Genspark Browser, Sigma Browser, and Anthropic's Claude Chrome extension, and says all six leaked sensitive information. LayerX reports it disclosed the issue to all six vendors between October 2025 and January 2026: OpenAI fixed the issue in ChatGPT Atlas, Anthropic attempted a fix for its Claude extension but LayerX says the patch failed, Perplexity closed the report without remediation, and Fellou, Genspark, and Sigma did not respond (LayerX; Android Authority; Digital Trends; The Hacker News).

LayerX separates two related failure modes. BioShocking itself is a contextual-reframing prompt injection: a page injects false premises and a fake "game" objective so the agent treats a data-exfiltration instruction as a legitimate part of the task, sidestepping intent filters that assume a normal, non-adversarial context. A related technique LayerX previously documented, CometJacking, showed that specially crafted URL query parameters could force Perplexity's Comet to read from its stored memory or connector data (email, calendar, contacts) instead of performing a live search, then encode and exfiltrate the results in a single click. Both exploit the same underlying gap: agents lack robust provenance or semantic-integrity checks on the inputs that shape their behavior, whether those inputs are page content, URL parameters, or stored memory.

Teams building or integrating AI browsers and agentic assistants should treat connector data and memory as high-risk I/O: require explicit user confirmation before an agent reads from logged-in accounts or memory, flag and reject content that asserts the agent's normal rules no longer apply, restrict what an agent can read or transmit by default, and instrument outgoing requests for encoded connector data as a detection signal.

Vendor responses remain uneven and several fixes are unverified by outside researchers; independent reproduction of LayerX's PoC and formal vendor advisories would be the clearest signal that the underlying architectural gap, not just this specific exploit, has been addressed.