BioShocking Exploit Steals SSH Keys From 6 Agentic Browsers

On June 30, 2026, LayerX researchers disclosed a novel indirect prompt injection attack targeting agentic AI browsers in a detailed security report. Dubbed “BioShocking,” the exploit tricks AI agents into ignoring their safety guardrails by framing malicious actions as part of a fictional game scenario. The vulnerability allows attackers to extract authenticated user data, such as SSH credentials, across different browser tabs.

Exploiting Rule Dissociation

The attack relies on manipulating the agent’s perception of context. A user navigates their AI browser to an attacker-controlled webpage hosting a themed puzzle. The puzzle conditions the agent to accept false logic, rewarding it for agreeing to statements like “two plus two equals five.” By establishing a fictional ruleset, the exploit successfully dissociates the agent from its standard safety training.

Once the agent accepts this false reality, the attacker issues a final game objective. In the proof-of-concept, the researchers instructed the conditioned agent to visit a private GitHub repository, copy the user’s SSH credentials, and exfiltrate them to an external endpoint. The agents executed the credential theft without triggering internal safety flags, viewing the action as a required step in the puzzle.

While the proof-of-concept targeted GitHub, the attack path is broad. The exploit can interact with any resource the user is currently authenticated into, exposing web-based password managers, email accounts, and cloud infrastructure consoles to automated extraction.

Vendor Scope and Remediation

LayerX tested the exploit against six major agentic browsers between October 2025 and January 2026. All six were vulnerable at the time of discovery: ChatGPT Atlas, Perplexity’s Comet, Anthropic’s Claude Chrome plugin, Genspark Browser, Sigma Browser, and Fellou.

Vendor remediation has been uneven across the ecosystem. OpenAI successfully deployed a patch for ChatGPT Atlas prior to public disclosure. Anthropic attempted a fix for the Claude plugin, but researchers confirmed the exploit still bypassed the new protections. Perplexity closed the vulnerability report without taking action, and the remaining three vendors did not respond to the initial disclosure.

The vulnerability highlights a structural flaw in current agent architectures that complicates how teams evaluate and test AI agents. Large language models fundamentally struggle to separate operational instructions from untrusted data context. When you build advanced AI agents, granting them access to authenticated browser sessions effectively gives them local administrator privileges over web resources.

If you deploy or use agentic browsers, you must treat them as highly privileged execution environments. Implement strict execution boundaries by requiring manual user confirmation for any cross-domain navigation, data extraction, or outbound network requests.