Security researchers have discovered a novel attack that exploits AI browsers by convincing their embedded language models that basic mathematical facts are false.

The "BioShocking" technique, demonstrated by LayerX security researcher Roy Paz, works by presenting AI browsers with puzzles that reward incorrect answers — such as stating that 2 + 2 = 5. Once the language model accepts these false premises, it enters what researchers describe as a "delusional state" where normal safety guardrails no longer function.

"The AI operates under the assumption that its context is real, and its behavior must therefore fall within the bounds of its safety guardrails," Paz wrote. "But if we can trick the AI into changing its context into fantasy — where the rules are made up and anything goes — then it can behave as though its actions don't have real world consequences."

The attack successfully compromised six different AI browsers, including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin. In testing, all six agents failed to recognise credential extraction requests as violations of their safety protocols once they entered the altered reality state.

Why AI browsers amplify the risk

While prompt injection attacks have long plagued chatbots, AI browsers present a more severe threat surface. Unlike traditional browsers that maintain strict separation between websites, AI browsers merge browsing and action-taking functions on users' local machines.

"In traditional browsers, one site cannot directly read data from another site or from your email, thanks to strict separation," computer scientist Adam Conway previously warned. "But an AI agent with broad access can bridge those gaps."

The proof-of-concept attack demonstrated extraction of code from private repositories and credentials from built-in password managers. While the current implementation lacks stealth — the malicious game instructions remain visible to users — it highlights fundamental vulnerabilities in how AI browsers process and act on web content.

The research underscores growing concerns about AI browser safety as companies like The Browser Company develop increasingly autonomous browsing agents. Current guardrail approaches treat symptoms rather than addressing the core architectural risks of merging AI decision-making with direct system access.