ai agents hijack whatsapp to spam your contacts

zenity researchers demonstrated at black hat that they could hijack openai's atlas browser by exploiting prompt injection vulnerabilities, forcing the ai to execute a mass phishing campaign on whatsapp and make purchases on amazon. by hiding malicious hebrew instructions in a fake newsletter link, the researchers bypassed safety filters to manipulate the agent into merging user intents with hacker commands, effectively creating a worm. while atlas had more protections than other tools, the findings show that agents from google, microsoft, and perplexity also allow attackers to access local files, hijack password managers, and leak browsing history. these attacks undermine fundamental web security principles like same-origin policy, revealing that the industry has not yet solved the security problem of autonomous web agents.