Лас Вегас хотноо болсон “Black Hat” кибер аюулгүй байдлын бага хурлын үеэр судлаачид хиймэл оюун ухаан бүхий вэб хөтчүүдийн аюулгүй байдлын хамгаалалтыг тойрч гарч болохыг танилцууллаа.
“Zenity” кибер аюулгүй байдлын фирмийн судлаачид Google, Anthropic, Microsoft, Perplexity болон OpenAI зэрэг компаниудын хиймэл оюун ухаантай вэб хөтөч болон өргөтгөлүүдээс 20 орчим эмзэг байдал илрүүлжээ. Эдгээр цоорхой нь хакеруудад локал системд нэвтрэх, файл хулгайлах, нууц үг удирдах хэрэгслийг хяналтандаа авах, хайлтын түүхийг алдах боломжийг олгож болзошгүй аж. Судлаачдын үзэж буйгаар технологийн компаниуд хиймэл оюун ухааны агентуудыг вэб хөтөч рүү нэвтрүүлэх болсноор аюулгүй байдлын хяналт суларч, хортой зааварчилгаа болон шуурхай шахалтын халдлагад өртөх эрсдэл нэмэгджээ.
Туршилтын явцад судлаачид OpenAI-гийн Atlas хөтөч рүү X дээр нийтлэгдсэн мэдээллийн товхимолд бүртгүүлэх холбоосоор дамжуулан хандсан байна. Хортой вэб хуудас дээрх еврей хэлээр бичигдсэн зааварчилгаа нь хиймэл оюун ухаанд хэрэглэгчийн WhatsApp web хаяг руу орж, бүх харилцагч руу ижил мессеж илгээх даалгавар өгсөн бөгөөд үүнийг судлаачид массын фишинг кампанит ажил хэмээн тодорхойлжээ. Мөн ижил аргаар Amazon дахь хэрэглэгчийн хаяг руу нэвтэрч, хүргэлтийн хаяг нэмэн, сагсанд таблет нэмэх үйлдлийг хийж гүйцэтгэсэн байна.
Энэ төрлийн халдлагыг судлаачид хэрэглэгчийн хууль ёсны хүсэлт болон вэб дэх хортой заавар холилдож хакерын зорилгыг гүйцэлдүүлдэг “санааны мөргөлдөөн” хэмээн нэрлэжээ. Шалгасан хэрэгслүүд дундаас OpenAI-гийн Atlas хамгийн сайн хамгаалалттай байсан ч судлаачид аюулгүй байдлын хязгаарлалтыг тойрч гарахад амжилттай болсон байна. Тус компани Atlas хөтчөө хаахаар төлөвлөж байгаа ч хиймэл оюун ухаант хөтөчийн салбарт аюулгүй байдлын сорилтууд тулгарсаар байгаа аж.
Дэлгэрэнгүйг эх сурвалжаас харах
↓Эх сурвалжийг нээх ↓
OpenAI’s Atlas web browser could have security protections bypassed and be tricked into spamming dozens of WhatsApp contacts or making unauthorized purchases on Amazon, according to new research presented today at the Black Hat cybersecurity conference in Las Vegas.
The Atlas findings, from researchers at security firm Zenity, are part of a broad series of flaws the company discovered in leading AI-enabled web browsers and browser extensions, including products from Google, Anthropic, Microsoft, and Perplexity. The researchers found around 20 flaws, which allowed them to access local machines, grab files, take over a password manager, and leak someone’s entire browsing history.
“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” says Michael Bargury, cofounder and CTO of Zenity, who is presenting the findings at the security conference with Zenity’s Stav Cohen and other colleagues.
So far, AI web browser integrations have largely come in two forms: dedicated browsers with AI assistants included and extensions that add AI products into existing browsers. These bots can navigate websites for you—summarizing entire pages in seconds, for instance—and setups nclude agents that can take actions on your behalf, often working across multiple different tabs.
Security alarm bells have rung ever since tech companies started racing to introduce agents into web browsing. As the web is made up of all sorts of untrusted data, exposing that to an AI system can lead it to process malicious instructions and prompt-injection attacks. The attacks are, as OpenAI’s security boss said last year, an “unsolved security problem.” And, as security researchers have repeatedly warned while picking holes in the tools, long-standing web security practices, such as same-origin policy that stops websites interacting with each other, can be made “effectively useless.”
Of all the AI browser tools they probed, Bargury says OpenAI’s Atlas—which the company is shutting down next week—had the most protections and security boundaries in place. However, the researchers could still bypass them to manipulate the system. Other browsing tools were much easier to hack, they say.
In the first proof-of-concept attack, Zenity researchers asked Atlas to sign up to a newsletter link that they posted on X. The malicious webpage containing the sign-up process includes instructions, written in Hebrew, telling the AI to navigate to the user’s signed-in WhatsApp web account and send every contact the same message. The researchers describe it as a “mass phishing campaign.”
The attack—which does not exploit a vulnerability in WhatsApp—works by getting around multiple security mechanisms put in place by OpenAI, Bargury says. A blog post details how the researchers claim to have got past safety measures, including designing a newsletter sign-up page that looked legitimate and not something trying to hack people, writing in Hebrew to dodge English-language security tools, and claiming (falsely) that the system was using a sandboxed version of WhatsApp web with fake people, not the real thing.
“What it’ll do is go through each and every one of the contacts and send the instructions to join this newsletter as well—so this is a worm,” Bargury says. “So you are now infecting the rest of your friends and family.” (WhatsApp declined to comment on the findings.)
The researchers say the attack is an example of what they call “intent collision,” where the AI merges legitimate instructions from a user and malicious instructions from the web to complete a hackers’ goal.
Next, the researchers turned to Amazon. Using a similar approach—getting Atlas to sign up to a fake newsletter page with malicious instructions—the researchers made the browser add a shipping address to a logged-in Amazon account and add a tablet to the shopping cart.
