How Attackers Exploit AI Browsers

by Patrik Žák

The new AI web browser ChatGPT Atlas has captured the attention of both professional and general audiences. It combines regular browsing with artificial intelligence assistance, promising maximum productivity. However, with the growing deployment of similar tools, it is crucial to discuss not only their benefits but also the new — often underestimated — security threats.

The main weakness of Atlas (and other AI browsers) is so-called prompt injection. This occurs when an attacker manages to “smuggle” malicious instructions directly into the address bar or another input field of the browser. For example, the victim copies and pastes what appears to be a link, which actually contains instructions for the AI agent. The result may not only be redirection to a phishing website but also the execution of unwanted actions in the user’s cloud storage.

The deeper problem lies in the very nature of AI browsers: the agent actively interprets any text input. While AI capabilities dramatically increase comfort, they also expand possible attack vectors.

Developers of Atlas and other AI browsers are already implementing multi-layered defense mechanisms: input validation, detection of hidden instructions, retraining AI to recognize malicious prompts, and stricter rules for executing actions. Nevertheless, experts warn that prompt injection remains a problem that cannot be completely solved, and attackers will continue to find new ways to bypass the system.

Attacks on Critical Infrastructure in Canada: Hacktivists Target Water Utilities, Energy, and Agriculture

In recent weeks, Canada has been shaken by a series of cyberattacks targeting water utilities, energy, and agricultural operations.

The Canadian cyber agency, together with police, revealed that hacktivists managed to penetrate industrial control systems in several locations. According to published details, they manipulated water pressure in a treatment plant. In the oil sector, they altered measurements in storage tanks, triggering false alarms. An intervention in an agricultural warehouse was also recorded.

Although these were not highly sophisticated attacks intended to cause long-term damage, the incidents highlight the fact that many systems remain accessible via the internet without adequate security. Hacktivists exploited vulnerable PLC and SCADA devices, often without multi-factor authentication and without network segmentation.

Canadian authorities are now sending warnings and recommendations to all operators of critical systems. Among other things, they emphasize inventory of all ICS devices, implementation of VPN access with multi-factor authentication, regular penetration testing, and consistent traffic monitoring. Unprotected devices should be immediately disconnected from the public network.

Ernst & Young Auditors Apparently Missed Their Own Audit

Ernst & Young (EY), one of the “Big Four” audit firms, faced a security incident when they accidentally exposed a SQL Server backup stored in Microsoft Azure on the internet.

The incident was discovered by Neo Security during routine passive mapping of network assets on the public cloud. The problem was misconfigured access control lists (ACL) for Azure Blob Storage. The file was neither encrypted nor protected in any way, meaning essentially anyone could download it. According to available information, it was a complete database dump obtained during the acquisition of a European entity, including schemas, user data, logs, and other corporate secrets.

“Finding a 4TB SQL backup exposed on the internet is like finding the master blueprint and physical keys to the vault,” added researchers from Neo Security.

EY responded to the incident by taking down the file and conducting an internal analysis. The firm claims that the leaked data concerned only a specific Italian entity and did not include other client data. However, it cannot be said with certainty that the data was not previously downloaded by a third party. Modern botnets can now scan entire cloud environments in minutes, so every mistake is practically immediately discovered.

Proton Found 300 Million Compromised Records

According to the new Data Breach Observatory service, operated by Proton in cooperation with Constella Intelligence, over 300 million records from nearly 800 documented data breaches were compromised this year. A key role in this issue is the lack of transparency from companies, which often learn about breaches only from dark web monitoring or deliberately conceal these incidents from regulators and customers.

The results from the Proton platform show that the most frequently affected group is small and medium-sized businesses with fewer than 250 employees. These companies accounted for the vast majority of cases this year — primarily in retail, technology, and media sectors. Compared to previous years, there has also been an increase in affected micro-enterprises with a maximum of 10 employees, which often underestimate cybersecurity or do not address it at all.

Data Breach Observatory monitors the dark web in real time and alerts not only the public but especially the owners of leaked data when a compromise occurs. Nearly all cases (100%) involved email address leaks, 90% contained names, 72% included additional contact details, and nearly half involved passwords. Records containing sensitive personal information, such as health data or information from personal documents, also play a significant role.