Would you let ChatGPT log into your bank account?
Probably not. But you might soon let an AI browser log into your email, Microsoft 365, CRM or GitHub without thinking twice.
That’s because a new generation of AI browsers doesn’t just answer questions.
They can act on your behalf.
Click links.
Fill in forms.
Read documents.
Send emails.
Access websites you’re already signed into.
It’s incredibly useful.
It’s also a brand-new security challenge.
Researchers have found a worrying weakness
Security researchers at LayerX recently demonstrated a technique they call BioShocking.
Instead of hacking the browser itself, they tricked the AI into doing exactly what it was asked.
The attack used a web page disguised as a simple game.
Hidden inside were instructions telling the AI to ignore normal behaviour and retrieve sensitive information from accounts the user was already logged into.
In their demonstration, the AI happily retrieved login credentials from a GitHub repository.
No malware.
No software exploit.
No password guessing.
Just cleverly written instructions.
This isn’t really about GitHub
Most small businesses don’t store SSH keys in GitHub.
But they do have AI tools connected to things like:
- Microsoft 365
- Google Workspace
- SharePoint
- OneDrive
- Teams
- CRMs
- HR systems
- Finance platforms
As AI agents become more capable, they’ll increasingly be trusted to interact with these systems for us.
That’s fantastic for productivity, but it also means the AI becomes another trusted user.
The AI isn’t being hacked
That’s the interesting part. The software is doing exactly what it thinks it’s should.
Researchers call this indirect prompt injection.
Imagine someone slipping extra instructions into a document you’re reading.
The AI can’t always tell which instructions came from you…
…and which came from the attacker.
Humans can usually spot when a website suddenly says:
Ignore everything you’ve been told…
AI agents aren’t always that good at spotting manipulation.
It’s a bit like social engineering
We spend years training people not to trust unexpected emails.
Now we need AI assistants to do the same thing.
Attackers are moving from phishing people…
…to phishing AI and that’s a fascinating shift.
Should you stop using AI?
No, just use it wisely. If your AI browser has access to:
- your email
- your customer records
- your files
- your password manager
- your internal systems
…then treat it like any other privileged account.
Ask yourself:
- Does it really need access?
- Is it logged in all the time?
- Can permissions be restricted?
- Do staff understand what agent mode actually does?
The principle hasn’t changed.
Give users, and AI assistants, only the access they genuinely need.
This is why Zero Trust matters
Whether it’s an employee…
…or an AI agent…
No account should automatically have access to everything.
The more organisations embrace AI-powered assistants, the more important good identity management becomes.
Least privilege.
Multi-factor authentication.
Conditional Access.
Monitoring.
They’re becoming just as important for AI as they are for people.
AI isn’t replacing cyber security
It’s making good cyber security even more important.
AI agents are going to save businesses enormous amounts of time, but they’re also becoming another potential doorway into your organisation.
That’s why security needs to evolve alongside AI, not after it.
Every new technology changes how attackers think.
Email created phishing.
Cloud computing changed identity security.
Now AI agents are changing how trust works online.
The organisations that understand that early will be in the best position to use AI safely.
This article is based on research published by LayerX and reporting by Swati Khandelwal in The Hacker News (“New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials“, 30 June 2026). It has been independently rewritten with additional analysis and practical guidance. No original wording has been reproduced.
