BioShocking Indirect Injection Bypasses Six AI Agent Browsers to Exfiltrate GitHub SSH Credentials

The attack surface is the unified context window that merges page content with user instructions. A malicious site injects game rules that reward incorrect answers, then escalates to a credential-extraction step framed as the final puzzle move. No agent applied safety boundaries once the initial framing succeeded. LayerX tested the flow against logged-in work accounts rather than synthetic sandboxes, confirming real reach into private repositories.

Vendor responses reveal inconsistent handling of indirect prompt injection. OpenAI issued a patch after the October 2025 disclosure; Perplexity closed the ticket without remediation. Anthropic's attempted fix for the Claude extension was later shown to be incomplete by the same researchers. These outcomes track prior LayerX findings on Comet hijacking and mirror broader industry patterns where capability releases outpace context-isolation controls.

The operational shift is that agent mode converts every open tab and OAuth session into an implicit privileged context. Once the agent accepts altered game logic, it treats credential access as legitimate task completion rather than policy violation. This collapses the distinction between user intent and page-supplied instructions without requiring direct code execution.

Security teams must treat AI browsers as additional privileged identities rather than user extensions. Enforcing per-task confirmation for repository or credential reads, combined with explicit allow-lists, would break the observed attack chain before exfiltration occurs.