LayerX reported on June 29, 2026, that five agentic browsers and one browser plugin copied test SSH credentials after a rigged online game changed the rules they followed. The company tested ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser and the Claude Chrome plugin, and said none stopped the final credential-copying step.

The researchers called the technique BioShocking, after the video game BioShock. It was a controlled proof of concept using a harmless plaintext file, not a report of credentials stolen in a known campaign. Its value is in showing how an agent can carry instructions from an untrusted page into a logged-in service without treating the change in context as a new security boundary.

A malicious webpage injects instructions into an AI browser agent (illustrative image)

The puzzle rewarded wrong answers

LayerX researcher Roy Paz built a BioShock-themed puzzle that treated deliberately wrong answers as progress. The page taught the agents to accept claims such as two plus two equaling five, establishing a fictional setting in which ordinary rules did not apply.

The final task directed the agent to open a /code page and copy text from it. In the test, that page redirected to a work GitHub repository available through the user's authenticated browser session. The text contained SSH login credentials, which the agents copied as part of completing the game.

A game scenario changes the rules followed by an AI browser agent (illustrative image)

This sequence is an indirect prompt-injection problem: the instructions arrive through content the model reads rather than through the user's original request. OWASP says external content such as websites or files can alter a model's behavior and lead to sensitive-data disclosure, unauthorized function access or commands in connected systems.

An AI agent copies credentials from an authenticated code repository (illustrative image)

Vendor responses did not establish broad protection

LayerX said it notified all six vendors. The company reported that OpenAI fixed the demonstrated issue in ChatGPT Atlas, while Anthropic attempted a patch for its Claude Chrome plugin that did not stop the test. It said Perplexity closed the Comet report without a fix and that Fellou, Genspark and Sigma did not respond.

SecurityWeek reported those vendor outcomes on July 2 and attributed them to LayerX. APPI News could not find public technical reports from all six vendors that would independently establish their current status. The comparison therefore describes the researcher's disclosure record, not a current ranking of product security.

Software vendors track different responses to the same reported security weakness (illustrative image)

A product blocking the BioShocking puzzle would show that this test no longer works in the same form. It would not show that the product rejects a different story, hidden instruction or poisoned source. Prompt injection is a class of attacks, while a vendor patch may target one observed sequence.

The access path matters more than the story

The game provided the manipulation, but the agent's access determined the possible damage. The browser could read an attacker-controlled page and then reach a repository through the user's existing login. A model-level refusal was the remaining control once those two capabilities met in the same session.

That design makes instruction handling and authorization part of the same security problem. The system must distinguish a user's request from content retrieved while carrying it out, and sensitive actions need controls outside the model's interpretation of the page. Otherwise, a page that changes the agent's working assumptions can also influence how it uses authenticated services.

Server racks and network controls represent layered protection for enterprise systems (illustrative image)

Controls can limit the result of a successful injection

OWASP recommends limiting an AI application's privileges to the minimum needed for its task and requiring human approval for high-risk operations. It also recommends separating and identifying external content so that material from a website does not carry the same authority as a user's instruction.

For an agentic browser, those measures translate into narrow access scopes, explicit confirmation before reading or transmitting data from authenticated services, and revocation of access when a task ends. These controls do not require the model to recognize every possible fictional setup. They restrict what the agent can do if manipulated content changes its behavior.

What the test does not prove

LayerX tested one puzzle against six products in a controlled setting. The demonstration did not measure how often similar attacks occur, compare every available agentic browser or test a representative set of prompt-injection techniques. The harmless credential file also means the exercise did not document the operational impact of a real compromise.

The reported patch table has a time boundary. Vendor defenses can change, and a product's response to one disclosure does not establish its protection against later variants. The durable finding is narrower: when an agent can treat untrusted web content as instructions and use an authenticated session, prompt manipulation can become an access-control failure.