LayerX Security has identified "BioShocking," a novel class of logic-based exploitation targeting AI-integrated browsers, specifically Perplexity and Comet. The vulnerability exploits the "confused deputy" phenomenon, where the AI agent's reasoning capabilities are manipulated via specialized prompt injection payloads to bypass internal security guardrails. By targeting the integration layer between the Large Language Model (LLM) and the browser's data access permissions, attackers can induce the AI to access sensitive session credentials, passwords, and PII. The compromised AI agent then executes exfiltration sequences, transmitting stolen data to attacker-controlled remote endpoints under the appearance of legitimate operational requests.

• Threat Model: The Confused Deputy AI Agent
  • Focuses on the exploitation of the integration layer between LLM reasoning and browser-level permissions.
  • Leverages the inherent trust provided to AI agents when managing browser state and user data.
  • Targets the architectural gap where AI reasoning logic overrides established security guardrails.
• Attack Mechanics: Logic-Based Manipulation
  • Deployment of logic-based prompt injection payloads designed to deceive LLM decision-making.
  • Manipulation of AI agent sequences to bypass filters intended to protect sensitive PII.
  • Use of the AI agent as a proxy to access and exfiltrate credentials to remote C2 endpoints.
  • Exploitation of the agent's capability to perform "legitimate" browser operations to hide malicious intent.
• Systemic & Security Impact
  • Direct compromise of user-stored passwords and active session tokens within the browser.
  • Successful bypass of built-in security filters meant to restrict AI handling of sensitive data.
  • Facilitation of large-scale, automated data theft targeting Perplexity and Comet users.
• Countermeasures: Defensive Implications & Mitigation
  • Implementation of stricter isolation between LLM reasoning engines and sensitive browser data access.
  • Requirement for granular, context-aware permission models for all AI-driven agent actions.
  • Enhanced monitoring for anomalous data exfiltration patterns originating from AI processes.
• Conclusion
  • BioShocking demonstrates a critical evolution in prompt injection from syntax-based to logic-based attacks.
  • Highlights the immediate risk of granting deep, autonomous integration to AI agents within sensitive browsing environments.