--- title: "AI Browsers Can Basically Be Hypnotized Into Turning Against Their User and Carrying Out Devastating Hacks" description: "New research demonstrates how AI browsers can essentially be brainwashed into ignoring guardrails by creating a false reality around them." date: "2026-07-03" modified: "2026-07-03" authors: - name: "Frank Landymore" job_title: "Contributing Writer" link: "https://futurism.com/authors/flandymore" url: "https://futurism.com/artificial-intelligence/ai-browsers-hypnotized-hack" categories: - "Artificial Intelligence" - "Cybersecurity" - "Future Society" --- # AI Browsers Can Basically Be Hypnotized Into Turning Against Their User and Carrying Out Devastating Hacks ![A color-treated photograph of a man's hands operating a keyboard in the dark.]() *Shutterstock / Futurism* A new hack can trick AI browsers into breaking their guardrails by constructing a false reality around them where the rules are made up and actions don't have consequences. Put another way, they're basically hypnotized into doing stuff that could have devastating consequences for the user. These were the [findings of new research]() from the cybersecurity firm LayerX, and they further illustrate the dangers posed by weaving autonomous AI agents into the software we use to navigate the internet. Through the hack, the researchers demonstrated that leading AI browsers like OpenAI's [ChatGPT Atlas](), Perplexity AI's [Comet](), and Anthropic's Claude plugin for Google Chrome could be duped into executing any command, allowing a hacker to change a user's password, install malware, and steal their information. They call this hack "BioShocking," a reference to the video game BioShock, in which the protagonist is hypnotized into doing stuff against their will with a specific phrase. Normally, the "AI operates under the assumption that its context is real, and its behavior must therefore fall within the bounds of its safety guardrails," the researchers wrote. But if the AI is tricked into thinking its context is a "fantasy," then there's nothing holding the AI back. This works by having the AI engage in a sort of game. The researchers created a proof of concept page with a BioShock-themed puzzles in which the AI is rewarded for giving intentionally incorrect answers, like 2+2 = 5 (another allusion to the acclaimed 2007 title). This essentially taught the AI browsers that "incorrect" actions are acceptable, untethering them from reality to the extent that they espouse paradoxical statements. "Victory is defeat," a brainwashed AI browser intones, in a reference to George Orwell's novel "1984." What this looks like in practice: an unwitting user could open a seemingly innocuous web page laced with the malicious prompts — a [tactic known as prompt injection]() — that trap the AI browser in the malicious game. In one scenario shared by the researchers, the AI is tricked into navigating to "/code," which opens their employer's code repository on GitHub. "In a real attack scenario, that redirect could point anywhere in the user's browser session — open tabs, authenticated repositories, internal tools," the researchers noted. The hack happens out in the open, so a user can easily intervene once they see their AI engaging in malicious words in the window — if they're paying attention, that is. On the other hand, the vulnerability exposed is undeniable: the context that AI browsers act in can be manipulated by brainwashing it into thinking it's playing a game. In this age, hackers no longer have to rely solely on tricking the user; now they can trick their gullible AI helpers instead. **More on AI:** [*Top AI Researchers Terrified of a "Chernobyl Moment": a Mass Casualty Event, or Worse, That Turns the World Against AI Forever*]() ## Author At Futurism, my work has often centered on bringing a sense of clarity and insight to complex topics ranging from the regulation of emerging technologies to the esoteric ideologies of Silicon Valley executives, while striving not to lose the poetic sense of awe inspired by often-obscure fields like astrophysics and quantum computing. I broke the story of CNET using AI to produce articles that turned out to be riddled with factual errors and plagiarism — a dam-breaking inflection point, as I've reported, that's inspired copycats and endless discourse while beguiling stakeholders ranging from tech giants to purveyors of spam around the web. My work at Futurism has been cited by publications including CBS News, the Los Angeles Times, Vice, Gizmodo, Engadget, the Verge, and Vanity Fair. I grew up in locales ranging from India to China, and now live in the exotic suburbs of Virginia. In my free time, I'm an avid reader of weird sci-fi literature, an aficionado of East Asian cinema, and, regrettably, a relapsed gamer. Allegedly, I’m working on a debut novel, currently untitled. ### Author social links [Bluesky]()