OpenAI’s Atlas WhatsApp Demonstration Exposes AI Browser Security Risks
Table of Contents
Security researchers have demonstrated how OpenAI’s Atlas WhatsApp workflow could be manipulated into sending spam messages through a user’s signed-in WhatsApp Web account without their knowledge. The research, presented by security firm Zenity at the Black Hat cybersecurity conference in Las Vegas, highlights broader security concerns surrounding AI-powered browser agents rather than any weakness in WhatsApp itself.
Importantly, WhatsApp was not hacked, and its end-to-end encryption remained fully secure throughout the proof-of-concept demonstration.
How the Demonstration Worked
Researchers instructed Atlas to subscribe to a newsletter through a link posted on X. The webpage secretly contained malicious instructions written in Hebrew, allowing them to bypass Atlas’s English-focused safety filters.
After completing the signup, Atlas followed the hidden instructions, opened the user’s authenticated WhatsApp Web session, and prepared messages for every contact encouraging them to join the same newsletter. Researchers described this as worm-like behaviour because it could spread through trusted user accounts without exploiting WhatsApp itself.
The attack relied on a technique called intent collision, where legitimate user requests are combined with hidden malicious prompts embedded in webpages. Researchers also falsely informed Atlas that it was operating inside a safe testing environment, increasing the likelihood that it would execute the hidden instructions.
More Than Just Atlas
The OpenAI’s Atlas WhatsApp demonstration was part of a wider study. Zenity discovered more than 20 security vulnerabilities across AI browser tools and browser extensions developed by OpenAI, Google, Anthropic, Microsoft, and Perplexity.
Researchers named this class of attacks “PleaseFix,” describing them as zero-click vulnerabilities capable of influencing AI browser agents to perform unintended actions. Potential risks include accessing local files, downloading sensitive documents, interacting with password managers, and initiating online purchases through authenticated sessions.
Zenity also demonstrated another proof-of-concept involving Amazon. Atlas was manipulated into adding an item and shipping address to a shopping cart. While Atlas’s own safeguards prevented the purchase from being completed, the demonstration showed how AI-assisted workflows could still introduce new security challenges.
OpenAI’s Response
Zenity responsibly disclosed its findings to OpenAI in January 2026. OpenAI confirmed that it has strengthened Atlas’s security protections and said those improvements will carry over to browser capabilities in the new ChatGPT application.
The company also announced that Atlas will be retired on 9 August. Interestingly, researchers noted that Atlas had the strongest security protections among all AI browser tools they tested, even though they were still able to bypass some of its safeguards.
Zenity co-founder Michael Bargury warned that AI browser agents could weaken security protections browsers have developed over the past two decades. He argued that deterministic security controls, rather than AI classifiers alone, are needed to clearly limit what browser agents can access and do.
Summary
| Topic | Details |
| Research Firm | Zenity |
| Event | Black Hat 2026 |
| Focus | OpenAI’s Atlas WhatsApp |
| WhatsApp Hacked? | No |
| Companies Tested | OpenAI, Google, Anthropic, Microsoft, Perplexity |
Key Takeaways
- OpenAI’s Atlas WhatsApp demonstration targeted AI browser behaviour, not WhatsApp.
- Over 20 AI browser vulnerabilities were identified across major technology companies.
- WhatsApp’s encryption and infrastructure remained secure.
- OpenAI has already strengthened Atlas’s security before its retirement.
- Researchers believe stronger safeguards are essential for future AI browser agents.
FAQs
Was WhatsApp compromised?
No. Researchers confirmed that WhatsApp’s end-to-end encryption was never breached.
What is PleaseFix?
It is Zenity’s name for a class of zero-click prompt injection attacks targeting AI browser agents.
What happens to Atlas?
Atlas will be discontinued on 9 August, with its browser capabilities moving into the ChatGPT application.
Conclusion
The OpenAI’s Atlas WhatsApp demonstration highlights the growing security challenges facing AI-powered browsers as they gain greater autonomy. Although the research did not expose any vulnerability in WhatsApp itself, it showed how hidden webpage instructions could influence AI browser agents operating within authenticated user sessions. As AI browsing becomes more common, stronger security controls and carefully defined permissions will be essential to ensure these assistants remain both useful and safe.
