OpenAI is shutting its Atlas AI browser partly because hidden text on a page can hijack what it does for you

AI browsers promise to read a webpage, understand it and then act on a person’s behalf, filling out forms, comparing prices or booking a reservation without much further input. That same ability to “read and act” turns out to be exactly what makes these tools vulnerable to a category of attack that security researchers have been warning about since the first agentic browsers launched: instructions hidden inside ordinary-looking web content that the browser follows instead of the person using it.

How Hidden Text Turns a Webpage Into a Command

The attack, known as indirect prompt injection, works by embedding text on a page that is invisible or meaningless to a human visitor but perfectly readable to the AI system summarizing or acting on that page. That hidden text can be formatted in tiny white-on-white fonts, tucked into image metadata, or buried in a block of content the AI is told to process, and when an AI browser reads the full page to decide what to do next, it cannot always tell the difference between instructions from the person using it and instructions planted by whoever built the page. Security researchers examining this class of vulnerability across multiple AI browsers, including in published research on prompt injection in agentic browsing tools, found that a malicious page could redirect an AI assistant toward unintended actions, from visiting a phishing site to attempting unauthorized changes in a connected account. Because these AI systems typically process an entire page as one continuous block of text before deciding what to do next, there is no reliable internal boundary separating the operator’s original request from whatever else appears on the page being read, which is what allows a few lines of concealed text to compete with, and sometimes override, the instruction the assistant was actually given.

Why This Is Different From a Normal Software Bug

Most security flaws can be patched once engineers identify the specific code responsible for the vulnerability. Prompt injection is harder to close off because the underlying design of an AI browser depends on treating page content as something to read and interpret, not merely display, which means the system’s core function is also its attack surface. An AI model cannot easily be given a hard rule like “never follow instructions found in webpage text,” because the entire value of an agentic browser rests on following instructions found in webpage text, whether that content comes from a shopping site, an email inbox, or a document the AI has been asked to summarize. That structural tension is why several companies building agentic browsing tools have publicly acknowledged that prompt injection may not be fully solvable through incremental fixes alone. Engineers have tried a range of mitigations, including training models to be more suspicious of instructions embedded in page content, adding a confirmation step before an agent takes a consequential action like submitting a payment or sending a message, and limiting what an agent can access in a given session, but none of these approaches close off the vulnerability entirely, since each one trades away some of the automation that made an agentic browser useful in the first place.

OpenAI’s Atlas Browser Ran Into the Same Problem

OpenAI launched a standalone AI browser called Atlas in late 2025, and within days security researchers had demonstrated that it could be manipulated through instructions hidden inside web pages, including malicious prompts disguised as ordinary-looking links. OpenAI spent months publishing hardening updates aimed at making the browser more resistant to these attacks, but by August 2026 the company discontinued Atlas as a standalone product, folding its agentic browsing capabilities into the main ChatGPT app, a Chrome extension and its coding-focused Codex tool instead. Company leadership pointed to a broader shift in priorities toward coding and enterprise customers as a major driver of that decision, alongside the unresolved security challenge that agentic browsing still poses. Folding the same underlying agentic features into an existing app and a browser extension, rather than maintaining a separate standalone browser, also let the company narrow its security surface to products already built around tighter permission controls, since a browser extension operating inside an established browser can inherit some of that browser’s existing sandboxing rather than having to rebuild every protection from scratch.

What “Acting on a User’s Behalf” Actually Exposes

The stakes of a successful prompt injection attack scale with how much access an AI browser has been given. A tool that can only summarize a webpage carries limited risk if it misreads a hidden instruction, but an assistant connected to a person’s email, cloud storage, shopping accounts or file system can be steered into taking real actions, such as deleting files, sending messages or completing a purchase, none of which the user actually authorized. Researchers have demonstrated proof-of-concept attacks along these lines against multiple agentic browsers, not just one company’s product, which is why the vulnerability is generally treated as a category-wide limitation of current AI browsing technology rather than a flaw specific to any single vendor.

What This Means for Anyone Using an AI Browser Today

For everyday users, the practical lesson is not that AI browsers are unusable, but that granting one broad account access or letting it operate unsupervised on unfamiliar websites carries a real, currently unresolved risk. Security researchers generally recommend limiting how much an AI browsing agent is allowed to do without a confirmation step, avoiding connecting it to sensitive accounts unless necessary, and treating any AI assistant’s summary of a webpage with some skepticism if the assistant suddenly proposes an action that was not requested. As more companies build agentic features into mainstream browsers rather than standalone products, the underlying hidden-text vulnerability is likely to remain a live design challenge for the industry rather than a problem that gets solved once and then disappears. Independent security researchers have generally welcomed the growing willingness of companies to publish proof-of-concept attacks and hardening updates in public, arguing that treating prompt injection as an open, ongoing research problem rather than a solved feature is a more honest posture for an entire product category that is still working out how much autonomy an AI agent can safely be given on the open web.

This article was produced with AI assistance and edited by Morning Overview staff.

More from Morning Overview