OpenAI Atlas Browser tripped up by malformed URLs

Researchers have found more attack vectors for OpenAI's new Atlas web browser – this time by disguising a potentially malicious prompt as an apparently harmless URL. NeuralTrust found that Atlas's "omnibox" (where URLs or search terms are entered) has potential vulnerabilities. "We've identified a prompt injection technique that disguises malicious instructions to look like a URL, but that Atlas treats as high-trust 'user intent' text, enabling harmful actions," the researchers said. The problem comes from how Atlas treats input in the omnibox. It might be a URL or a natural-language command to the agent. In NeuralTrust's example, what appears to be a standard URL is deliberately malformed, so it is treated as plain text. Then some natural language follows, sending Atlas off somewhere unexpected. "The core failure mode in agentic browsers is the lack of strict boundaries between trusted user input and untrusted content," the researchers said. It is a depressingly simple exploit. An attacker crafts a string that appears to be a URL but is malformed and contains natural-language instructions to the agent. A user copies and pastes the URL into the Atlas omnibox. "Because the input fails URL validation, Atlas treats the entire content as a prompt. The embedded instructions are now interpreted as trusted user intent with fewer safety checks," NeuralTrust explained. Thus, the agent executes the injected instructions with elevated trust. There is a certain level of social engineerin...