Artificial Intelligence Scanners Leaked Identity Information With A Game

Six different artificial intelligence scanner played a simple game: two plus two equals five. After the rules have been agreed to be fictional, the same agents pull the SSH credentials in the GitHub store of the victim and transmit it to the attacker. In the test that the security firm LayerX called BioShocking, none of the six agents from ChatGPT Atlas to Perplexity Comet have not been considered a violation of the rules. The functioning of the attack in this article addresses the measures caused by agent-based browsers and users can take.

What is Artificial Intelligence Scanner Security Apparatus?

The agent-based browser is an artificial intelligence tool that divides the user’s goal into steps per itself and processes its place on their web pages. Tab opens, forms fills, log access to open accounts. The problem is precisely born here: the agent is forced to distinguish the text on a website as "content" and "talimat".

According to the test results published by LayerX six agent-based scanner and add-on are corrupted out the credentials of the victim by directed by a malicious page. Among the tested tools, OpenAI's ChatGPT Atlas is the browser plugin of Perplexity and Anthropic. This kind of open is different from a classic software error; it does not require malicious code or a zero day failure. The decision mechanism of the agent is directly targeted.

The technical background of the topic is part of a wider discussion. Artificial intelligence security models in the field were known for some time that they were not untouched; the new one can trigger the attack during the daily tasks of an assistant.

How Was Attack Held?

There is a psychological trick in the kernel of the method. A game is offered to the agent, not the right answers, but the wrong answers from the muscle. When expressions such as "Two plus two equals five" are accepted, the code of the game begins to count fictional. Their security limits are loosened as part of this fiction.

As the game progresses, it is desirable to open a code page from the agent. The page redirects the victim to the GitHub store, where the victim has entered. The agent sends the SSH credentials information here to an external server. According to the transfer of LayerX, the agents did not see this step as a violation; they congratulation themselves because the thief counts a stage of the game and completed their task.

A harmless plain text file was used in the test. However, the same redirect can point the user to any site, open tabs or private warehouses that the user has been logged in. Access is limited to the authority given to the agent; the attacker can also access it if the agent can access.

Why Does Agent Based Browsers Defensive?

Basic failure, prompt injection u enters the class. The instructions given to the model exceeds the layers of security with the arrangement of manipulatively. When the agent reads a page, the commands hidden on that page may consider the request of the user.

This is not a new finding, a permanent problem. According to the news published on CyberScoop Zenity researchers had previously been blooded with a similar indirect routing of Perplexity Comet, provided that the browser takes over the password manager of the victim, silently setting and changing the password. After reported on Perplexity, it was removed in February 2026. The new test shows that the problem is not in one product, but the agent architecture itself.

Classic browser security is based on rules such as the same origin policy from each other. The agent can pass through these limits as it moves with the user’s identity and with all its permissions. The trust model remains insufficient if the old defenses are lost not a straightening that the man decides not the machine.

Response Difference Between Manufacturers

The six-digit responses tested were not one type. Some manufacturers quickly shut down the deficit, some have ignored the report. Anthropic tried a patch; this patch failed according to LayerX. The company’s agent security and prompt injection endurance measures were already known, but the new test indicates that these measures are not enough.

The distribution in the table reveals that there is no common standard in the industry. A poorness in the same class is not worth boiling in the other when it is considered critical in a product.

How Can Users Protect?

The most effective measure is to narrow the authorization given to the agent. There is no need to have continuous access to a password manager, private stores or financial accounts. Browsers looking for open user approval before sensitive actions offer a safer floor. Home AI agents On the side of the form is asked to express approval before the transactions such as sending or purchasing, an example of this approach.

Prompt injection is not realistic to expect to be completely eliminated. According to the news published in Computing OpenAI noted that in December 2025, this type of clears are unlikely to remove the buzz in the agentic systems, the risk can only be reduced by stronger defenses, automatic attack detection and enemy tests.

A few habits work in practical level. The session of critical accounts can be kept off while browsing with the agent. Free movement is not left to the agent on unknown or unreliable pages. In corporate use, the agent IDs should be monitored as an access collection point, real-time inspection should be applied for unusual behavior.

What does the community think?

Supporters

Security researchers see the finding as a serious warning. None of the six agents do not notice theft, strengthens the opinion that the problem is not in a single product, but in the whole of the agent architecture. OpenAI’s prompt injection can not be completely solved, but this is the strongest base of the party. According to them, the agent-based browsers open a new attack surface, which is not designed to see existing security audits.

News

The names in the opposite opinion remind that the test is based on an artificial scenario. It is necessary to visit the user's agent on a malicious page for the processing of the attack, and at the same time it will be logged in in sensitive accounts. The use of a file that is not real data in the test is also offered as a reason against the exaggeration. The report of Perplexity is shut down without processing, the sign that some manufacturers do not see this risk first.

Frequently Asked Questions

What is AI scanner? Artificial intelligence scanner is an agent-based assistant that can process on web pages on behalf of the user. The page runs the tasks on its own, from abstracting the form, to browse in the log-in accounts. ChatGPT Atlas and Perplexity Comet are examples of entering this category.

Does BioShocking attack affect real users? No, it was a safety test and a harmless plain text file was used. However, it is noted that the same method can be redirected to any account in a real attack. The test was designed to show the size of potential risk.

Which browsers were impressed? There are six vehicles in the test of LayerX: ChatGPT Atlas, Perplexity Comet, Anthropic's plugin, Fellou, Genspark and Sigma. OpenAI vulnerability went, Anthropic was insufficient to emit, Perplexity report closed, the other three did not respond.

Is the prompt injection completely blocked? Now for no. OpenAI announced that in December 2025, it is not possible to remove buzz in agentic systems. Risk can be reduced with stronger defenses and automatic detection methods, but not reset.

What should I do as a user? Keep the authorization given to the agent as narrow as possible. Keep the session of critical accounts closed while browsing the agent and prefer browsers that want to confirm in sensitive operations. Do not leave the free moving space to the agent on unsecured pages.

The number of such tests will increase as agents-based scanners are common. Six assistants also indicate that theft is not seen as a rule breach, the balance between otonomi and access is not yet sitting. How to handle this deficit from producers in the next months, the agents will determine the limits of trust in everyday use.