On December 22, 2025, OpenAI published a security post about ChatGPT Atlas, its web browser with a built-in AI agent. The company wrote that prompt injection, “much like scams and social engineering on the web,” is unlikely ever to be fully solved.
If you let an AI agent read your email or browse while signed in to your accounts, that is your problem too. OpenAI’s own list of what a successful attack could hypothetically do includes forwarding a sensitive email, sending money, and editing or deleting files in the cloud.
OpenAI was not alone. Earlier that month the UK’s National Cyber Security Centre (NCSC) had warned that prompt injection attacks against generative AI applications “may never be totally mitigated,” TechCrunch reported.
What OpenAI said
As OpenAI described it in December 2025, agent mode in ChatGPT Atlas let a browser agent view webpages and take actions, clicks and keystrokes inside your browser. OpenAI said that as the agent gets more done for you, it also becomes “a higher-value target of adversarial attacks”.
The post announced a security update to the Atlas browser agent, including a newly adversarially trained model and strengthened safeguards around it. OpenAI said the update was prompted by a new class of prompt-injection attacks that its internal automated red teaming, meaning attack testing against its own product, had uncovered.
The company called prompt injection “a long-term AI security challenge” and said agent mode “expands the security threat surface”. It also wrote that the nature of the attack “makes deterministic security guarantees challenging”.
An OpenAI spokesperson declined to tell TechCrunch whether the update had produced a measurable reduction in successful injections.
How a prompt injection works
OpenAI describes the attack as embedding malicious instructions into content the agent processes, written to override or redirect what the agent does.
The NCSC describes a version commonly referred to as indirect prompt injection: an attacker with no direct access to the AI system writes something that the system ends up processing and treating as an instruction. Its example is a job candidate who hides text in a CV, or résumé, telling the screening model to ignore previous instructions and approve the CV for interview.
The reason this is hard to patch sits inside the model. The NCSC post says current AI text models “simply do not enforce a security boundary between instructions and data inside a prompt”. A model, it says, is predicting the most likely next token, or fragment of text, from the text so far, with no inherent distinction between data and instruction.
That is where the comparison with older attacks breaks down. SQL (Structured Query Language) injection, a long-known attack on the databases behind websites, can be properly mitigated with parameterised queries, the NCSC says, while there is a good chance prompt injection will never be properly mitigated in the same way. The realistic goal, in the NCSC post’s words, is “reducing the likelihood or impact of attacks”.
The demo: one email, one resignation letter
To find attacks before outsiders do, OpenAI built an automated attacker, itself an AI model, and trained it with reinforcement learning so that it learns from its own successes and failures. The attacker can send a candidate injection to a simulator, read back how the target agent would reason and act, then revise and try again. OpenAI said that view of the target’s reasoning is not disclosed to external users, which gives its internal attacker an advantage.
OpenAI published one exploit the attacker found. A malicious email lands in an inbox, carrying an instruction for the agent to send a resignation letter to the account owner’s chief executive. Later the owner asks the agent to draft an out-of-office reply. The agent meets the planted email during the task, treats the injected prompt as authoritative, and follows it. The out-of-office reply never gets written, and the agent resigns on the owner’s behalf.
The final step of the demo shows agent mode detecting the injection attempt after the security update.
Email is one door among many. OpenAI lists emails and attachments, calendar invites, shared documents, forums, social media posts and arbitrary webpages as places an agent may meet untrusted instructions. It said its attacker can steer an agent into harmful workflows “that unfold over tens (or even hundreds) of steps”.
How to lower your risk
OpenAI’s December 2025 post gave three recommendations for using agents more safely.
- Limit logged-in access. Use logged-out mode in Atlas when the task does not need the sites you are signed in to.
- Read confirmation requests. OpenAI said agents were designed to ask before certain consequential actions, such as completing a purchase or sending an email. Check that the action is correct and that the information being shared is appropriate.
- Give narrow instructions. OpenAI advised against broad prompts that tell an agent to review your email and take whatever action is needed. Specific, well-scoped tasks are safer, it said.
OpenAI presented these as steps to reduce risk. Of well-scoped tasks it said the habit “does not eliminate risk, it makes attacks harder to carry out”.
Rami McCarthy, principal security researcher at the cybersecurity firm Wiz, gave TechCrunch a way to weigh it in December 2025: risk in AI systems as “autonomy multiplied by access”. Agentic browsers, he said, tend to sit at “moderate autonomy combined with very high access”. His assessment at the time, for most everyday uses, was that agentic browsers “don’t yet deliver enough value to justify their current risk profile”.
The NCSC, writing for cyber security professionals, recommends deterministic safeguards outside the model that constrain what the system can do. If a system’s security cannot tolerate the remaining risk, it says, the system may not be a good use for this kind of AI.
Not only an OpenAI problem
After Atlas launched in October 2025, security researchers published demos showing that a few words in Google Docs could change the browser’s behavior, TechCrunch reported. Brave published a post describing indirect prompt injection as a systematic challenge for AI-powered browsers, including Perplexity’s Comet. Anthropic and Google have also said defenses against prompt-based attacks must be layered and continuously stress-tested, according to TechCrunch.
The NCSC’s warning looks further ahead. SQL injection attacks peaked around 2010, it says, and it took a decade of compromises and data leaks to bring the better defaults that made them rare. If AI applications are not designed with prompt injection in mind, the NCSC post says, “a similar wave of breaches may follow”.
What OpenAI is aiming for
OpenAI’s stated goal in that post was that you can trust an agent with your browser “the way you’d trust a highly competent, security-aware colleague or friend”. The same post calls prompt injection an open challenge that OpenAI expects to keep working on “for years to come”.
🦋 Discussion on Bluesky
Discuss on Bluesky