OpenAI Browser Flaw Lets Hackers Spam WhatsApp

Researchers at security firm Zenity say OpenAI's Atlas browser can be manipulated into sending unwanted WhatsApp messages to dozens of a user's contacts or completing purchases on Amazon without permission. The findings, unveiled today at the Black Hat cybersecurity conference in Las Vegas, cover roughly 20 separate flaws Zenity uncovered across AI-enabled browsers and browser extensions built by OpenAI, Google, Anthropic, Microsoft, and Perplexity.

The vulnerabilities go beyond spam messages. Zenity's team found ways to reach into local machines, pull files off a device, hijack a password manager, and expose a person's full browsing history. The research points to a pattern across the industry: as companies race to bolt AI agents onto web browsers, letting them read pages, fill out forms, and act across multiple tabs, they're also reopening security gaps that browser makers spent two decades closing.

Zenity cofounder and CTO Michael Bargury is presenting the results alongside colleague Stav Cohen and others. Their work lands at a moment when browser AI agents are shifting from novelty features into everyday tools, handling tasks like summarizing pages and executing multistep actions, often without a person double-checking each step.