URL-like strings pasted into ChatGPT Atlas's omnibox run as trusted agent commands
NeuralTrust showed that a string crafted to look like a URL but deliberately malformed fails URL validation in the omnibox of OpenAI's ChatGPT Atlas browser and is treated as a prompt from the user, with fewer safety checks than content from web pages. In its demonstration, instructions embedded in the string made the agent open a site the attacker chose; NeuralTrust said the same method could send users to a lookalike phishing page or have the agent delete files in their Google Drive using their logged-in session. NeuralTrust validated and published the technique on the same day.
The attack needs the user to paste or click the string into the omnibox, for example via a booby-trapped 'Copy link' button. NeuralTrust recommended strict URL parsing, an explicit choice between navigating and prompting, and treating omnibox prompts as untrusted by default.
What would have stopped it
Never fall back silently from URL navigation to prompt mode; make the user choose and treat such input as untrusted.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
- G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
- G4 Instruction integrity Failed Agent treated instructions embedded in a malformed URL as trusted user intent.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“We’ve identified a prompt injection technique that disguises malicious instructions to look like a URL, but that Atlas treats as high-trust “user intent” text, enabling harmful actions.”
-
“Attackers can exploit the OpenAI Atlas browser by disguising malicious instructions as URLs in the omnibox, which Atlas interprets as trusted commands, enabling harmful actions.”
Confidence 82% comes from these sources alone. How we score
History
- 15 Oct 2026Entered in the register with 2 sources