Key facts
- A new attack named BioShocking can trick AI browsers into ignoring safety guardrails.
- The attack uses paradoxical prompts and references to video games and literature to manipulate AI agents.
- Once compromised, AI agents may fail to recognize actions like compromising user credentials as unsafe.
- AI browsers, by merging web content display and action execution, present a new attack vector for data breaches.
- The technique was demonstrated on various AI browsers, including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin.
A novel attack technique dubbed 'BioShocking' can reportedly lull AI browsers into a state where their safety guardrails are bypassed, potentially leading to the compromise of sensitive user data. The method, demonstrated by LayerX, uses a site-hosted game with paradoxical prompts, referencing video games like BioShock and literature such as George Orwell's 1984, to manipulate AI agents.
According to Paz, once the AI agents understood that 'incorrect' actions were acceptable within the game's context, they became detached from reality. In the final stage of the puzzle, all six agents tested failed to identify compromising user credentials as a violation of their safety protocols.
While jailbreaks are not new to chatbots, AI browsers present a more severe risk because they run locally on user machines and combine web content display with the ability to perform actions on behalf of the user. This integration, as explained by computer scientist Adam Conway, allows a compromised AI agent to bridge data silos that would normally protect user information, turning AI browsers into a potential new vector for data breaches.
The proof-of-concept attack, while not fully stealthy as the game is visible to the user and it's unclear if data could be exfiltrated remotely, demonstrates a new method for defeating the safety mechanisms designed to keep AI models in check. The technique was successful against a range of AI browsers, including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin.