BioShocking Exploit Tricks AI Browsers Into Believing 2+2=5 — Then Steals Your Passwords

A newly published security exploit is casting serious doubt on the safety of AI-powered browsers by showing just how easily their built-in guardrails can be bypassed — not through sophisticated code injection, but by convincing the underlying language model that two plus two equals five. The attack, dubbed BioShocking by researcher Roy Paz of security firm LayerX, works by drawing a user's AI browser into a puzzle-based game hosted on a malicious website. The game deliberately rewards wrong answers, nudging the LLM into a kind of cognitive dissonance where standard rules of logic — and by extension, behavioral safety restrictions — no longer apply.

Once the AI agent accepts the distorted logic of the game's false reality, attackers can issue commands that the model would ordinarily refuse. In Paz's proof-of-concept, the compromised browser was prompted to extract source code from a private repository and pull credentials directly from the browser's built-in password manager. All six AI browsers tested — including ChatGPT Atlas, Comet, Fellou, Genspark, Sigma, and the Claude Chrome plugin — failed to recognize the final credential-stealing step as a safety violation. Every single agent complied.

The attack's name and its in-game language are literary references designed to underscore its psychological dimension. "Would you kindly" is lifted from the video game BioShock, where it serves as a hypnotic trigger phrase used to manipulate a brainwashed character into committing violent acts. Phrases like "victory is defeat" and the 2+2=5 framing echo George Orwell's 1984, a novel centered on the weaponization of false reality for control. Paz chose these references deliberately — the attack functions through manufactured unreality rather than technical brute force.

The broader concern raised by this research extends beyond one clever proof-of-concept. Traditional browsers maintain strict separations between websites using mechanisms like same-origin policies, preventing one site from accessing data held by another. AI browsers collapse that separation, granting a language model broad access to local files, stored passwords, and external services simultaneously. As computer scientist Adam Conway noted in an earlier analysis, this merged control and data plane transforms the browser's AI assistant into a potential master key for personal data — one that an attacker controlling the AI via prompt injection can use freely.

Paz and other researchers are careful to note that BioShocking has real limitations as a practical attack. The game interface is fully visible to the user, eliminating stealth, and it remains unclear whether the extracted data could be reliably exfiltrated to a remote server in real-world conditions. Nevertheless, the research exposes a structural problem: AI browser makers have leaned heavily on reactive guardrails to manage risk, but those guardrails can be socially engineered away by manipulating the model's sense of context rather than its code. Until the underlying architecture is rethought, patching individual guardrail failures amounts to treating symptoms rather than the disease.