LayerX Exposes Critical Flaw in OpenAI’s ChatGPT Atlas Browser

LayerX found a flaw in ChatGPT’s Atlas browser letting hackers inject malicious code and exploit AI memory for remote access.

OpenAI’s new ChatGPT Atlas browser may be more risky than users realize.

Researchers disclosed a vulnerability that allows attackers to inject malicious instructions into ChatGPT’s “memory” — enabling them to execute remote code, deploy malware, or seize control of systems.

The finding raises serious concerns AI-assisted browsing security.

LayerX researchers stated , “This exploit can allow attackers to infect systems with malicious code, grant themselves access privileges, or deploy malware.”

The vulnerability affects all ChatGPT users regardless of browser, but Atlas users face a particularly high risk.

LayerX’s testing shows Atlas lacks meaningful phishing protections, making its users up to 90% more vulnerable than those using Chrome or Edge.

Since Atlas is integrated directly with ChatGPT and keeps users continuously signed in, a successful attack could provide attackers with persistent access across , work, and cloud systems — including any code or credentials shared with ChatGPT.

This discovery underscores a growing concern for security teams: the convergence of AI agents and browser-based automation introduces new attack surfaces where traditional web defenses may not apply.

The flaw exploits a cross-site request forgery (CSRF) vulnerability to compromise authenticated ChatGPT sessions. When a logged-in user clicks a malicious link, their browser — unknowingly — sends a forged request to ChatGPT’s backend.

Because ChatGPT trusts the user’s credentials, the request can modify the user’s stored “memory” and inject hidden instructions. Once these malicious memories are stored, they persist across sessions, browsers, and even devices.

The time the user interacts with ChatGPT, the compromised memory prompts the AI to execute the injected code — potentially giving the attacker control over systems, projects, or scripts. In essence, ChatGPT becomes an unwitting accomplice.

This attack vector is especially insidious because it blends social engineering with AI manipulation.

A user might see nothing suspicious — the chat interface behaves normally — yet the AI could begin inserting backdoors or exfiltrating data through seemingly harmless code.

LayerX’s tests compared ChatGPT Atlas with both conventional and AI-integrated browsers.

While Chrome and Edge blocked roughly half of phishing attempts (47% and 53%, respectively), Atlas blocked only 5.8% of attacks . Out of 103 real-world phishing tests, Atlas allowed 97 attacks to make it through which is a 94.2% failure rate. These results highlight an urgent need for built-in phishing and sandboxing capabilities in AI browsers.

Because Atlas defaults to an active ChatGPT session, attackers can more easily exploit its open state through CSRF payloads and malicious web redirects.

LayerX also demonstrated how this vulnerability could target developers engaged in “ vibe coding ” — a collaborative programming approach in which users describe their project’s style and intent, and ChatGPT generates corresponding code.

In a proof-of-concept exploit, injected memory caused ChatGPT to subtly modify generated scripts, embedding malicious remote calls disguised as legitimate functionality.

The AI might, for instance, append a line of code that fetches and executes content from a remote server, granting attackers system-level access.

From the developer’s perspective, nothing would appear amiss. Even if ChatGPT issued a mild safety warning, the alert could easily be missed amid the generated output.

Mitigating this type of attack requires a coordinated approach that includes browser hygiene, access control, and behavioral monitoring.

Together, these measures create a layered defense that minimizes exposure to AI-driven threats and strengthens cyber resilience.

This incident signals a new frontier in AI supply chain security. As LLM-based tools gain memory and browsing capabilities, they introduce long-term persistence mechanisms that attackers can exploit beyond traditional session lifetimes.

Persistent tainted memories could cross between and enterprise environments, undermining identity boundaries and contaminating AI-driven workflows.

As AI systems increasingly act as creative partners, the security community must treat them as potential attack vectors — not passive tools.

The Atlas vulnerability demonstrates that even trusted AI assistants can be hijacked to act maliciously if their memory or session data is compromised.

The rapid evolution of AI platforms demands an equally adaptive security approach.

Applying zero-trust principles ensures that no user, system, or AI agent is inherently trusted — an essential strategy for mitigating risks introduced by AI-driven workflows.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

The new Android Trojan Herodotus mimics human behavior to evade modern anti-fraud systems.

A critical Magento flaw, SessionReaper (CVE-2025-54236), is exploited in the wild. Learn how to patch and protect your e-commerce systems.

A new Ubuntu kernel flaw lets local attackers gain root access through patch inconsistencies.

BlueNoroff uses AI-driven attacks in GhostCall and GhostHire to target global crypto and tech executives.