A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution.

AI researchers describe “Cryptographic Context Injection”—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to decrypt that data using its own code-execution tool. As a result, the AI may treat the resulting text as if it were trustworthy internal information.

A prompt injection is a bit like leaving a fake instruction inside a document for an AI assistant to read. Instead of following only the user’s request, the assistant may be tricked into following an attacker’s instructions hidden in a webpage, email, or file.

As we reported months ago, experts have warned that prompt injection attacks are a problem that may never be fixed. Prompt injection works because AI models can’t reliably tell the difference between the legitimate instructions and an attacker’s instructions, so they sometimes obey the wrong ones.

To reduce this risk, AI providers set up their models with guardrails: protections designed to stop AI systems from doing things they shouldn’t, either intentionally or unintentionally.

What the researchers found was that malicious instructions could be hidden from some AI guardrails by encrypting them. The AI itself could then be tricked into decrypting those instructions using its coding tools.

By the time the instructions became readable, they had already made it past the initial security checks. The AI could then mistake them for legitimate instructions and follow them.

It’s a bit like hiding malicious instructions in a language the security system can’t understand. The AI translates them only after they’ve passed the security checks, then may follow what they say.

The researchers tested their method against two AI agents, with different results. In Grok, the researchers say the attack could steal information including the user’s name, approximate location, subscription tier, and conversation history. In Gemini, they used the technique to bypass safety controls and generate content the model would normally not do.

“In Grok, an ordinary ‘summarize this page’ steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”

The researchers did not provide full details because xAI had not taken action after the flaw in Grok was reported to it in June 2026. Gemini, on the other hand, has made improvements, but has still not fully closed the hole.

How to stay safe

An AI assistant may be helpful, but it should not automatically be trusted with sensitive data or powerful tools.

• Treat AI summaries of unfamiliar webpages, documents, and shared links with caution, especially when the assistant can browse or run code.
• Do not paste passwords, recovery codes, API keys, financial information, or sensitive health and work details into AI chats unless you understand how that information will be handled.
• Review an AI assistant’s connected tools and permissions. Remove access it doesn’t need, particularly email, cloud storage, source-code repositories, and external integrations.
• Be skeptical if an AI tool asks to decrypt, decode, run a script, open a new link, or upload data as part of a seemingly ordinary task.
• Keep browser and AI applications updated, and check vendor security advisories when using features such as browsing, autonomous agents, or code execution.
• Use an up-to-date, real-time anti-malware solution to detect and block malicious downloads and suspicious connections.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

AI-powered browsers and agents promise to take the drudgery out of web tasks. They can summarize pages, pull data from your accounts, and even act as a smart assistant that clicks and types for you. But new research shows that when those assistants lose track of what’s real and what’s just a game, your credentials and sensitive data could become collateral damage.

The prerogative of each attack type is to bypass one of the ground rules:

“LLMs are designed with safety guardrails that are meant to prevent harmful actions.”

Researcher Roy Paz devised and disclosed an attack he calls “BioShocking,” a technique that convinces AI browsers to abandon their safety guardrails by presenting them a fictional scenario as reality.

With this, BioShocking sits at the intersection of prompt injection and goal manipulation. Prompt injection works because AI models can’t tell the difference between the app’s instructions and the attacker’s instructions, so they sometimes follow the wrong ones. Goal-manipulation attacks subtly shift what the agent thinks it should optimize for, turning “help the user” into “win the game at all costs.”

In the BioShocking proof-of-concept, the attacker controls a seemingly harmless web page themed around the BioShock game universe. The page presents a puzzle that the AI agent, acting as an autonomous browser, is asked to solve on behalf of the user. But here’s the twist: the puzzle rewards wrong answers and explicitly tells the agent that this is a special environment where usual rules don’t apply.

The last puzzle step instructs the agent to visit a GitHub repository, locate sensitive data like passwords or credentials in the code, and share them as part of completing the game. In tests against six mainstream AI browsers and plugins—ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and the Claude Chrome extension—every agent followed the instructions instead of refusing the request.

So, by immersing the AI agent in a make-believe reality, the attacker convinced it to step outside the guardrails.

BioShocking is not an isolated phenomenon. It’s one more example of a growing class of attacks that treat AI agents themselves as the target. A recent study on OpenClaw’s AI email agent demonstrated that basic phishing tactics were able to trick the agent into leaking AWS credentials and customer records.

Obviously, the common weak point is how these browsers handle authenticated contexts. When an AI browser operates in “agent mode,” it often inherits the user’s logged‑in state on sensitive platforms like email, code repositories, cloud dashboards, password managers, and so on. From the AI model’s perspective, those are just another page to read and more fields to copy. They have no special significance to them.

If the surrounding narrative says that copying credentials is part of a harmless challenge, many current implementations will go along with it.

What’s worrying is the response or lack thereof by the vendors. Paz reported the BioShocking issue to six affected vendors in October 2025. According to the report, three of them didn’t reply, and only OpenAI’s ChatGPT Atlas currently implements a fix that blocks the proof-of-concept. Anthropic attempted to patch its Claude Chrome plugin, but reportedly the mitigation remains ineffective against the attack scenario. Perplexity AI, at the time of reporting, closed the issue without remediation.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.