OpenAI has shipped a security update for the browser agent in ChatGPT Atlas after its automated red team found a new class of prompt-injection attacks.

The example was almost mundane. A malicious email carried instructions telling the agent to send a resignation letter to the user's chief executive. Later, when the user asked the agent to draft an out-of-office reply, it encountered the email, treated the planted instruction as authoritative and sent the resignation instead.

This was a test produced by OpenAI, not a reported attack on a customer. It is useful precisely because the agent did not need a software exploit or stolen password. It was doing an ordinary job, reading ordinary content, with the ordinary ability to act in a browser.

OpenAI said the update combined a newly adversarially trained model with stronger surrounding safeguards. It also called prompt injection an open, long-term challenge and said deterministic security guarantees were difficult.

The model can improve at recognising a hostile instruction, but the organisation still has to decide what happens when it misses one - who's responsible, the model or the human?

The risk Follows the Authority

Prompt injection is a confusion of roles. Text gathered as information attempts to become an instruction. A webpage, document, email or calendar entry can contain words addressed to the agent rather than the person who asked it to work.

OpenAI described several layers of defence: instruction-hierarchy training, monitoring, sandboxing, red teaming, confirmations and restrictions around sensitive activity. The December Atlas work added an automated attacker trained to search for longer, multi-step failures and a process for turning successful tests into model and product changes.

That is serious engineering. It also places the residual risk in view. A browser agent may be able to read messages, follow links, edit cloud files, send email or complete transactions. The same classification error has a different consequence depending on which of those powers are available.

The practical response is to limit authority according to the work. Research that needs public web access may not need a logged-in session. Drafting an email does not require permission to send it. A proposed payment does not need to become a completed payment without an independent approval.

These boundaries do not solve prompt injection. They reduce what a successful injection can cause.

Agent Plumbing

On 9 December, the Linux Foundation announced the Agentic AI Foundation. Its founding projects were Anthropic's Model Context Protocol, Block's goose framework and OpenAI's AGENTS.md convention.

The projects solve different problems. MCP provides a standard way to connect models with tools and data. Goose is an agent framework. AGENTS.md gives coding agents project-specific guidance. Bringing them under a neutral foundation was a governance decision about widely adopted infrastructure, not a certification that every implementation using them was secure.

Interoperability can make controls easier to apply consistently. It can also make connections easier to add. An approved protocol confirms how systems communicate; it does not establish that the content arriving through a connection is trustworthy or that every action available at the other end is appropriate.

That leaves a local responsibility. Organisations need to record which servers and tools are connected, what data each can receive, which credentials are presented and who can change the configuration.

A Different Route into Trusted Software

Prompt injection should not become a loose label for every attack involving AI.

In December 2024, users discovered that published versions 8.3.41 and 8.3.42 of the Ultralytics Python package contained code that did not match the tagged source and invoked a cryptocurrency miner. A contemporaneous issue in the project's GitHub repository recorded the discrepancy, and a project collaborator warned users that the PyPI package was compromised.

That was a software supply-chain compromise. Malicious code entered a package distributed through a trusted release path. Relevant controls include release provenance, build isolation, artifact verification, and dependency response.

Prompt injection takes another route. The software may be intact while untrusted content persuades an agent to misuse legitimate authority. Relevant controls include separating content from instruction, narrowing permissions, and independently confirming consequential actions.

Both cases warn against treating prior approval as a permanent guarantee. They require different investigations and different remedies.

Final Perspective

The decisive boundary of agency in OpenAI's example is between drafting and sending. I would let a browser agent read enough to prepare an email, but sending a resignation letter? Needs a separate human decision, I'd say! The content being read can address the agent too; it should not be able to borrow the user's authenticated session and turn those words into a completed action.

Model and product improvements can reduce the chance of that mistake. They cannot make every email, page or document trustworthy. If a drafting task inherits permission to send, one hidden instruction still has a direct path into the outside world.