Exclusive: OpenAI’s Atlas browser — and others — can be tricked by manipulated web content

New research from SPLX and LayerX highlights critical vulnerabilities in AI browser agents, including OpenAI's Atlas, ChatGPT, and Perplexity AI, demonstrating how manipulated web content can be served to AI crawlers based on user-agent detection. This allows for the distortion of information used in automated processes, from financial promotions to job screenings, and exposes security flaws like unencrypted oAuth tokens and weak anti-phishing measures in Atlas. These findings underscore growing operational and data security risks for institutions leveraging AI, especially as a British Standards Institution report indicates U.S. businesses are significantly behind in establishing robust AI governance, signaling potential systemic liabilities.

Analysis

New research from SPLX highlights critical vulnerabilities in AI browser agents, including OpenAI's Atlas, ChatGPT, and Perplexity AI, demonstrating how manipulated web content can be served to AI crawlers based on user-agent detection. This allows for the distortion of information, enabling malicious actors to launch smear campaigns, display fake promotions, or manipulate automated processes like job screenings. OpenAI's current terms of service do not explicitly address this issue, contrasting with Google's proactive blocking of similar manipulative SEO tactics.

Further security concerns include LayerX's discovery of vulnerabilities allowing hidden instruction injection and potential remote code execution in ChatGPT, particularly dangerous for Atlas users due to a 90% higher phishing vulnerability. MongoDB CTO Pete Johnson also identified that Atlas stores unencrypted oAuth tokens with broad file permissions, making them easily accessible and usable by other processes. These findings highlight significant operational and data security risks associated with current AI agent implementations.

The broader context reveals a significant lag in AI governance, with British Standards Institution research indicating only 17.5% of U.S. businesses have an AI governance program, compared to 24% globally. This "striking absence of guardrails" suggests U.S. companies are "sleepwalking" into a potential AI governance crisis, failing to restrict unauthorized AI tools or understand their training data. This systemic oversight amplifies the risks posed by the technical vulnerabilities identified.

Key Decisions for Investors

• Scrutinize AI integration strategies and cybersecurity protocols of companies heavily reliant on or developing AI browser agents, assessing their exposure to manipulation and security flaws.
• Evaluate potential reputational, legal, and operational risks for portfolio companies whose public image or automated processes could be compromised by the identified AI vulnerabilities.
• Consider allocating capital towards cybersecurity firms specializing in AI security and governance solutions, anticipating increased demand for robust safeguards as AI adoption grows.
• Monitor regulatory developments and corporate responses to AI governance, particularly in the U.S., as stricter standards could impact companies with inadequate guardrails.