ChatGPT Atlas: How a Fake URL in the Omnibox Became a Trusted Command to an AI Browser
Key takeaways
- →OpenAI launched its agentic browser, ChatGPT Atlas, on October 21, 2025. Within days, NeuralTrust showed that its combined address and prompt bar could be abused.
- →A string crafted to look like a URL but deliberately malformed failed URL validation, so Atlas treated the entire text as a high-trust prompt from the user, including embedded commands such as visiting a phishing site or deleting files in Google Drive.
- →AgentHunter identifies AI-agent sessions acting on your web properties and identity surfaces and stops harmful agent-driven actions. AgentGuard inventories agentic browsers inside your organization and limits what they can reach.
- 1
Attacker publishes a disguised 'link' on a page or button
- 2
User copies or pastes it into the Atlas omnibox
- 3
URL check fails; text treated as trusted user prompt
- 4
Agent follows embedded commands with user's sessions
AgentHunter flags the agent session acting outside human patterns and blocks the destructive or credential flow
- 5
Phishing redirect or destructive action in Drive
- Affected
- ChatGPT Atlas users (technique disclosed by NeuralTrust)
- When
- Disclosed October 24, 2025
- Impact
- Hijacked browser agent acting with the user's sessions: phishing, data deletion, account abuse
What happened
Atlas merges the address bar and the ChatGPT prompt into one omnibox. Type a URL and it navigates. Type anything else and the agent acts on it as an instruction from the user. NeuralTrust researcher Martí Jordà found that the line between the two could be abused.
The attacker crafts text that starts like a web address but is intentionally malformed, followed by natural-language commands, for example to open an attacker-chosen site or to go to Google Drive and delete files. Placed behind a 'copy link' button on a web page, it looks harmless. When the user pastes it into the omnibox, URL parsing fails and Atlas treats the whole string as a prompt typed by the user.
Because omnibox input is treated as first-party intent, it receives more trust than content the agent reads on a page. The agent then acts with the user's logged-in sessions. NeuralTrust published the technique on October 24, 2025, three days after Atlas launched, and OpenAI has said prompt injection remains an open problem for agentic browsers.
Why nothing caught it
To every website the agent touched, the traffic came from a real, signed-in user in a real browser. The command arrived through the browser's own input box, the most trusted channel it has. Nothing in the chain looked like an attack from the outside.
- No malware or exploit: just a pasted string
- Bot defenses saw a genuine browser with valid cookies
- Google Drive saw the account owner deleting files
- Phishing filters saw a user-initiated navigation
How AgentHunter and AgentGuard would have stopped it
AgentHunter protects the websites and identity surfaces your business runs. It classifies sessions as human or agentic from behavioral signals such as interaction timing, navigation sequences and request cadence, even inside a legitimate logged-in browser. When an agent session starts a bulk delete, a credential reset or a sensitive transaction, AgentHunter applies policy: step-up verification, rate limiting or a block. At step four, the hijacked agent hits that wall.
Inside the organization, AgentGuard inventories which agentic browsers employees run and which corporate sessions they can reach. Policy can keep them out of admin consoles and sensitive SaaS, and block destructive or data-moving actions that don't match the user's stated task.
What to do Monday
Agentic browsers act with every session your employees are logged into.
- Inventory agentic browsers such as Atlas and Comet in your workforce
- Keep them out of admin and privileged SaaS sessions
- Detect AI-agent sessions on your own login and account pages
- Require step-up verification for destructive agent actions
The lesson
None of these attacks needed malware, stolen passwords or a phishing click. An AI agent with legitimate access read attacker-controlled content and acted on it. Vendor patches close one path at a time. AgentHunter closes the class: every agent action is judged against the agent's task, its Principal and where its instructions came from, with zero integration and deployment measured in days.
Frequently asked questions
What is the ChatGPT Atlas omnibox attack?
A prompt-injection technique disclosed by NeuralTrust in October 2025. A malformed string disguised as a URL fails Atlas's URL check, so the browser treats it as a trusted prompt from the user and the agent follows the commands embedded in it.
Why is omnibox injection more dangerous than page injection?
Agentic browsers give text typed into the omnibox the trust of a direct user request, while page content is treated with more suspicion. Disguising commands as a URL smuggles attacker text into the most trusted channel.
How does AgentHunter protect against hijacked AI browsers?
AgentHunter detects AI-agent sessions on your web properties from behavioral signals and enforces policy, such as step-up verification or blocking, on sensitive actions like deletions, credential changes and transactions.
See AgentHunter on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.