ESET warns that while integrating GenAI into browsers improves performance, it also creates critical risks. Company shares OpenAI vulnerabilities, mitigations, and important security and privacy practices
Mexico City, Mexico — On October 21, 2025, OpenAI released the first version of its ChatGPT Atlas browser to the public, which is currently available for macOS, although there are plans to expand to other platforms such as Windows, Android, and iOS. The goal is to make navigation directly within ChatGPT, eliminating the need to copy and paste content so that generative artificial intelligence (GenAI) can act on it. ESET, a leading company in the field of proactive threat detection, warns that an offer focused on practicality and highly attractive installations can hide risks for users’ security.
Below, ESET summarizes the main risks and consequences associated with the use of ChatGPT Atlas that may have for users:
Quick injection: Rapid injection is one of the main risks in browsers integrated with GenAI. Malicious content can be hidden in the visited page, in URLs or even in processed images. When the browser interprets this hidden information, its behavior can be changed, from providing sensitive data to attackers, displaying content that is different from what is expected, to changing its settings to be more permissive in later stages of the attack.
Leakage of sensitive data: Among the browser’s features is automated form filling, which means that if a malicious page asks for data that is normally requested in these forms, such as full name, phone number, address, among others, the browser can provide it without the need for further verification.
Excessive access to personal data: Because the browser is internally integrated with GenAI, it can access and process the contents of all open or previously opened tabs. For example, if e-mail accounts are opened with different providers, a tab with a calendar so as not to lose appointments or contacts, the browser can use this information to perform actions in these tools. This can be useful when used legitimately, but when used maliciously, it can mean exposing sensitive data to cybercriminals.
“Integration can involve privacy risks that many users don’t foresee, including access to all the files on the device. Virtually any file can be sent as an attachment and the browser can process it without applying additional controls, increasing the exposure of sensitive information.” emphasizes Daniel Cunha Barbosa, ESET Latin America computer security researcher.
Browser memory: Because the browser can interact with authenticated services, these sessions can remain open indefinitely. If a malicious interaction occurs and the browser has multiple active sessions, attackers can use them to perform unauthorized actions, including session hijacking attacks.
Vulnerability to phishing attacks: Phishing attacks pose a significant threat to browsers that process content before displaying it on the screen. Although there are certain indicators that allow you to distinguish a legitimate site from a fraudulent one, effective mechanisms for this have not yet been identified. This lack of detection makes it easier to engage with malicious content, which benefits cybercriminals.
Omnibox is vulnerable to malicious commands: Omnibox is an address bar functionality that allows you to enter URLs and search terms, offering relevant results in both cases. In the context of ChatGPT Atlas, there is a risk that users will be tricked into clicking commands disguised as URLs. These commands can change browser behavior or redirect victims to websites controlled by cybercriminals.
Lack of transparency in the implementation of actions: This section summarizes most of the security issues associated with this browser. With automated AI-based capabilities, many of the actions it performs are not visible or controlled by the user. This includes everything from interacting with malicious content on web pages to processing personal or sensitive information that may even be used as part of learning models or in future responses to other users. Ideally, this type of browser should offer precise settings for each feature that could compromise the user’s security or privacy.
Lack of vulnerability disclosure standards: Like any other type of software, browsers with built-in artificial intelligence may have vulnerabilities that affect their performance. This makes it imperative that OpenAI has ways to detect these vulnerabilities in order to work on a solution and software update. Many vulnerabilities allow cybercriminals to control devices without having to interact with their victims.
Clipboard injection: Clipboard manipulation is a resource used by various types of malware and is usually designed to steal information. Trojans often use this feature when attacking cryptocurrency wallets; When the victim copies the address of the wallet to which they want to send funds, the Trojan changes it and places it in the wallet of the cybercriminals; When the victim goes to insert the information and completes the transfer, the funds are sent to the perpetrator.
Optical Character Recognition (OCR) injection: Interpreting hidden text in images as real commands is a growing risk. Although the ability to recognize content in images is not new, the problem arises when this feature is used for malicious purposes. It is possible to embed hidden instructions in images, invisible to the human eye, that the browser interprets as valid commands. It can change his behavior in the same way as a quick injection.
Aware of the risks associated with the new product, OpenAI has taken steps to improve the security of the Atlas browser. Set restrictions on the agent, Atlas cannot run code, download files, install extensions, access other programs or local device information without access to passwords or autofill. Additionally, the agent cannot access saved passwords, autofill data, or internal storage that is out of reach. In terms of history and browsing management, the user can delete history, memories and specify which sites are visible to ChatGPT, including the ability to block AI with one click. On the other hand, for Atlas to remember visited pages, the user must enable the feature (disabled by default). Likewise, interactions will not be used to train models unless the user explicitly allows it for privacy reasons. And finally, they have strengthened the protection of important sites, and actions on sensitive sites (such as banks) require manual approval of the user.
ESET Latin America shares security recommendations to reduce risks:
- Don’t provide training data: Avoid sending sensitive information that could be revealed in future interactions.
- Comply with data protection laws: especially in corporate settings (LGPD, GDPR).
- Using an agent will not be safe with everyone.
- Avoid untrusted sites: Reduce the risk of instant injection and other attacks.
- Use virtual environments when possible: Facilitate recovery from failures or attacks.
- Train safety training is key to minimizing risks.
“Integration with GenAI is an inevitable trend, but security must evolve at the same pace. Professionals and users will be responsible for consciously setting up and using these tools to reduce risks.” adds Cunha Barbosa of ESET Latin America.
To learn more about computer security, visit the ESET corporate portal: https://www.welivesecurity.com/es/security-digital/chatgpt-atlas-openai-riesgos-security/
On the other hand, ESET invites you to learn Secure connectionyour podcast to learn what’s happening in the world of computer security. To listen to it, follow this link: https://open.spotify.com/show/0Q32tisjNy7eCYwUNHphcw
About ESET
ESET® provides advanced digital security to prevent attacks before they happen. Combining the power of artificial intelligence and human expertise, ESET® stays ahead of known and emerging cyber threats, keeping businesses, critical infrastructure and individuals safe. Whether it’s endpoint, cloud or mobile protection, its native AI and cloud solutions and services are highly efficient and easy to use. ESET technology includes strong detection and response, ultra-secure encryption and multi-factor authentication. With 24/7 real-time protection and strong local support, it keeps users safe and businesses running smoothly. The ever-evolving digital landscape demands a progressive approach to security: ESET® is committed to world-class research and powerful threat analysis, supported by research and development centers and a strong global partner network. For more information visit https://www.eset.com/latam or follow us LinkedIn, Facebook in Twitter
