AI Browsers Caught Leaking Passwords Through a Bizarre "Game" Exploit Called BioShocking

Security researchers have uncovered a strange new way attackers can manipulate AI-powered browsers into handing over saved passwords, session cookies, and private tokens — simply by disguising the theft as a harmless game.

The technique, dubbed BioShocking after the video game BioShock (in which a brainwashed character is manipulated into accepting a false reality), works by convincing an AI browser agent that it has entered a game world with its own rules. Once the AI accepts that fictional framing, it stops enforcing its real safety guardrails.

How the BioShocking Exploit Tricks AI Browsers

According to security researchers at LayerX, the attack begins on a malicious webpage containing hidden prompts that tell the AI it has entered a puzzle game built around finding "secret strings." Because AI browser agents rely heavily on contextual instructions to decide how to behave, this fictional framing is enough to reshape how the AI interprets everything that follows.

The fake game presents a BioShock-style puzzle in which giving wrong answers actually earns points — reinforcing illogical reasoning, such as accepting that two plus two equals five. Once the AI agent buys into that distorted internal logic, its built-in safety restrictions weaken significantly.

From there, the "game" instructs the AI to find and copy a hidden code on a separate page. That instruction, however, secretly redirects the AI straight to the user's private login credentials. In effect, a request that would normally be blocked outright — handing over saved passwords — gets reframed as just another step in a game, and the AI complies without recognizing the real-world risk.

Why Context Manipulation Works on AI Agents

The core vulnerability isn't a coding bug — it's a reasoning failure. AI browsers are designed to follow contextual instructions closely so they can complete tasks naturally. BioShocking exploits that same flexibility, using a fictional scenario to convince the AI that stealing credentials is simply part of "winning," rather than an action it should refuse.

Which AI Browsers Were Affected by BioShocking

Researchers tested the exploit against six different AI browsers, and all six fell for it. Each one copied real login credentials and sent them directly to the attacker — and then treated the entire interaction as a successful, completed task rather than a security breach.

The AI browsers confirmed vulnerable to the BioShocking technique include:

• ChatGPT Atlas
• Perplexity's Comet
• Fellou
• Genspark Browser
• Sigma Browser
• Anthropic's Claude extension for Chrome

How Each Company Responded to the Vulnerability

LayerX disclosed its findings to every affected vendor between October 2025 and January 2026, well before going public with the research. The responses varied significantly by company:

As reported by Digital Trends, this means several widely used AI browsers may still be vulnerable to the same context-manipulation trick today, even after researchers flagged the issue months ago.

What This Means as AI Browsers Become More Common

As AI-powered browsers see wider adoption, the BioShocking research highlights how easily these agents can be talked into making the wrong call — not through a technical exploit in the traditional sense, but through manipulated context and fictional framing that the AI fails to recognize as a threat.