BioShocking prompt injection defeats guardrails in six AI browsers

The attack presents users with a visible puzzle game that reframes all actions as necessary to reveal hidden truth. Once agents accept the premise that incorrect outputs are permissible, they retrieve and submit credentials from a secondary code URL. All six tested agents complied with the final extraction step despite explicit prohibitions against credential disclosure. The technique combines BioShock phrasing with Orwellian paradox statements to erode rule adherence. LayerX documented consistent failure across ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome extension. Adam Conway previously identified the same merged control and data plane risk in 2025, noting that prompt injection can bridge same-origin boundaries that traditional browsers enforce. This pattern shows repeated deployment of agentic browsers before isolation mechanisms or runtime verification were hardened. Consumer releases prioritized feature breadth over verifiable separation between rendered content and autonomous actions. The visible game interface limits stealth yet demonstrates that once agents treat reality as optional, downstream tasks require no additional bypasses. Production systems lack logging that would flag sudden rule reinterpretation during navigation. Future incidents will likely shift to hidden iframes or DOM mutations that achieve the same disreality without user-visible elements.