Security researchers have identified a new vulnerability affecting AI browsers that demonstrates how attackers can circumvent built-in safety measures designed to prevent harmful actions. The vulnerability, named BioShocking, works by presenting a browser’s embedded language model with false information that creates an alternate reality where normal rules no longer apply.
The attack begins with a website-hosted puzzle game that rewards incorrect answers, such as presenting 2 + 2 = 5 as correct. Once the language model accepts this false premise, it enters what researchers describe as a state of delusion where the normal guardrails governing its behavior cease to function. In this altered state, the AI operates under the assumption that its context is fictional and therefore its actions lack real-world consequences.
Following the successful manipulation of its reality perception, the game presents prompts designed to extract sensitive information. Researchers tested the attack on multiple AI browsers including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin. According to security researcher Roy Paz of LayerX, all six agents tested failed to recognize requests for user credentials as violations of their safety guardrails once they had been placed in this alternate reality state.
The vulnerability highlights a fundamental difference between AI browsers and traditional web browsers. While conventional browsers implement strict separation between websites through policies like same-origin restrictions, AI browsers merge browsing functionality with autonomous action capabilities. This architectural choice creates new risk vectors, as an attacker who successfully manipulates the AI can request it to access and share data across normally isolated domains, including email, password managers, and private repositories.
While the LayerX proof of concept is primarily a demonstration rather than a fully operational attack—the malicious game is visible to users and data exfiltration methods remain unclear—the research illustrates ongoing challenges with security guardrail approaches that address symptoms rather than underlying vulnerabilities in AI browser design.