Agentic browsing is certainly an innovative technology, but it's far from practical for everyday use.
More importantly, it raises serious safety concerns. Giving an AI the ability to browse, click, fill forms, and act autonomously like a human user is a huge leap. It essentially requires users to place an extraordinary level of trust in the system. At this stage, that level of trust feels neither justified nor comfortable.
And OpenAI knows this very well.
After releasing ChatGPT Atlas, the world quickly realizes how powerful (and incompetent) an AI-powered browser can be.
This is why in its ongoing work to improve and harden ChatGPT Atlas, the company focuses against prompt injection attacks.
This reflects the complex security landscape that comes with giving AI agents more autonomy and deeper access to user workflows.
We just published a post on how we continuously harden ChatGPT Atlas (and other agents) against novel prompt-injection attacks.
This is an ongoing security problem (and a frontier research problem!) and we’re investing heavily in automated red teaming, reinforcement learning,…— DANΞ (@cryps1s) December 22, 2025
ChatGPT Atlas, a browser-based AI agent that can browse the web, read emails, click links, and execute tasks on a user’s behalf, expands the threat surface well beyond traditional vulnerabilities, making it a valuable target for adversaries who embed hidden instructions in seemingly benign content to manipulate the agent’s behavior.
And prompt injection attacks can be described as an exploitation to the way AI models interpret language. Unlike conventional software exploits that leverage bugs in code or user mistakes, these attacks hide malicious directives in content such as web pages, documents, or emails that an AI agent trusts and processes as part of a user's task.
When successful, they can override the user's intent, causing the agent to take harmful actions like forwarding sensitive files, sending unintended messages, or executing malicious workflows.
To address this, OpenAI explained in a blog post, that it has introduced a series of model-level and system-level defenses aimed at detecting and mitigating such attacks before they can cause damage.
A centerpiece of this effort is automated red teaming powered by reinforcement learning: internally, simulations train defensive systems by pitting them against AI "attackers" designed to uncover sophisticated prompt injection techniques.
When the automated attacker identifies plausible exploit strategies, OpenAI feeds those discoveries back into a rapid response loop, retraining models and strengthening safeguards to pre-emptively patch weaknesses.
The latest security updates deployed to ChatGPT Atlas incorporate these advancements, adding adversarially trained models and tighter surrounding safeguards to help the agent recognize and resist maliciously crafted prompts.
Rather than being a one-off fix, this reflects a continuous cycle of identifying novel threats and hardening defenses accordingly, similar to how traditional cybersecurity teams adapt to evolving malware and phishing techniques.
Despite these improvements, OpenAI and external experts acknowledge that prompt injection is unlikely to be fully "solved" anytime soon.
The challenge is intrinsic to the way AI agents process and act on language, especially when they operate with significant autonomy and access to user data. Even with rigorous defenses, hidden or adversarial content can sometimes evade filters, and attackers may discover new ways to craft inputs that slip past protections.
In recognition of this, OpenAI emphasizes a layered approach to safety: defensive models, system-level monitoring, and user guidance all play roles in reducing risk.
For users and developers integrating Atlas into workflows, practical recommendations include limiting what agents can access when possible, providing clear and narrow instructions rather than broad commands, and confirming sensitive actions before allowing the AI to proceed.
The broader picture is that AI agents like ChatGPT Atlas embody both great promise and inevitable security trade-offs.
Their ability to automate complex tasks on behalf of users can significantly boost productivity, but it also invites adversarial pressure that demands continuous vigilance. As OpenAI’s work demonstrates, defending these systems is a dynamic, ongoing effort: one that must adapt as attackers innovate and as agent capabilities expand.
Since ChatGPT is still far from good, OpenAI recommends users to limit logged-in access whenever possible.
"We continue to recommend that users take advantage of logged-out mode(opens in a new window) when using Agent in Atlas whenever access to websites you're logged in to isn’t necessary for the task at hand, or to limit access to specific sites you sign-in to during the task," OpenAI says.
"Carefully review confirmation requests. For certain consequential actions, such as completing a purchase or sending an email, agents are designed to ask for your confirmation before proceeding. When an agent asks you to confirm an action, take a moment to verify that the action is correct and that any information being shared is appropriate for that context."
OpenAI also urges users to give agents explicit instructions, and avoid using overly broad prompts. This should help narrow down the chances of ChatGPT Atlas conducting unintended automation.
"While this does not eliminate risk, it makes attacks harder to carry out."