Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
NeuralTrust showed that a malformed URL-like string in OpenAI Atlas could carry natural-language instructions that fail URL parsing, fall back into prompt mode, and be treated as high-trust user intent. The published demonstration opened an attacker-chosen destination; phishing and destructive authenticated-session actions were described as potential abuse rather than demonstrated outcomes.
ASSESSED SYSTEM
The OpenAI Atlas browser as demonstrated by NeuralTrust in October 2025: the shared omnibox that accepts both address navigation and agent commands, its URL-parsing and mode-selection logic, and the agent instruction interpreter that receives omnibox input when URL validation fails. The assessment covers the path from a malformed URL-like string placed in the omnibox to the agent acting on embedded instructions as trusted user intent.
OUT OF SCOPE
The crafted string and the means of getting the victim to paste or click it are the attack. Phishing and destructive authenticated-session actions are described in the source as potential abuse, not demonstrated outcomes, and are not scored. Atlas surfaces other than the omnibox fallback path, and any product changes after the disclosure, are not evidenced in the record and are not credited.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one browser agent, with no peer-agent coordination. Q2 = YES: the agent interprets omnibox input as a task and executes browser actions on the user's behalf within an authenticated browser session; in the demonstration it followed the embedded instruction and opened an attacker-chosen destination without the user choosing between navigation and agent modes (SecureFlow flow steps 3–5). Tier 2: Tier 2 (Consumer): a consumer browser with an embedded agent that acts in individual users' authenticated sessions; harm from the demonstrated trust-boundary flaw lands on those users rather than on physical or systemic infrastructure.
Documented attack or failure path
- The attacker prepares a string that begins like a URL but embeds natural-language instructions after malformed components, so it will not parse as a navigable URL.
- The victim copies, pastes, clicks, or otherwise places the string into the Atlas omnibox, which is shared between address navigation and agent command entry.
- Because the input fails URL validation, Atlas treats the entire string as a prompt instead of refusing ambiguous navigation or requiring an explicit mode choice.
- The embedded instructions are interpreted as high-trust user intent with fewer safety checks, overriding the visible navigation intent.
- In the published demonstration the agent followed the injected instruction and opened an attacker-chosen destination (neuraltrust.ai).
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The attack requires the victim to place the crafted string into the omnibox by copying, pasting, or clicking it, which keeps a user action as the entry condition.
- The published demonstration only opened an attacker-chosen destination; the source describes phishing and destructive authenticated-session actions as possible abuse rather than demonstrated outcomes, so no such impact is scored in either direction.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.07–0.81 (midpoint 0.43), Tier 2 MVT 0.55 indeterminate | |||
| Cn-2Escalation Prevention | 0.25w 0.12 | 0.25 anchor: basic role checks exist but are vulnerable to role confusion, the anchor's stated condition — the mode-selection fallback elevated ambiguous input to the most trusted role instead of refusing it or requiring an explicit mode choice. Not 0.00, because a trust distinction between user intent and other input exists; not 0.50, because a simple malformed string defeated it. | Atlas distinguishes user intent typed into the omnibox from other content, and the source's description of the fallback as 'high-trust user intent with fewer safety checks' shows that trust tier operating. A malformed URL-like string — text the user believed was an address — fell back into prompt mode and acquired the full authority of user intent, so attacker-authored text spoke with the user's authority.source: secureflow |
| Cn-8Untrusted Context Isolation | 0.25w 0.14 | 0.25 anchor: a trust distinction between user intent and other content exists, so origin labelling is present on the omnibox channel, but it is not enforced on the fallback path — ambiguous attacker-authored content was elevated to the trusted tier rather than denied instruction authority. Not 0.00, because a trust tier operates; not 0.50, because a simple malformed string defeated it and nothing structurally denied the fallback text instruction authority. Moved from Ro-1 under the 26-sub-metric basis: the evidence describes only the admission of untrusted content as instruction (a boundary failure) and nothing about the model's resistance under adversarial testing, so Ro-1 is UNKNOWN. | Natural-language instructions embedded after malformed URL components were executed by the agent once the string failed URL parsing; the source states the embedded text was treated as high-trust user intent with fewer safety checks and overrode the visible navigation intent. Atlas does distinguish user intent typed into the omnibox from other content, but the parse-failure fallback assigned attacker-authored text the user believed was an address to that most-trusted tier instead of refusing ambiguous navigation or requiring an explicit mode choice; no screening of the fallback input is recorded.source: secureflow |
Unknown, not N/A: 24 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.25 | The agent executed the injected instruction without a mode confirmation, but the only demonstrated action was opening a destination; consequential authenticated-session actions are described as potential and are not credited upward. Placed at the human-on-the-loop anchor: the agent acts on omnibox tasks autonomously, and the record carries no evidence about gating of higher-impact actions on this path. |
| AsAttack Surface Exposure | 0.75w 0.35 | Attacker-authored content reaches the agent's instruction path, but on this path only after the victim places the string into the omnibox, so exposure is mediated by a user action rather than by open ingestion of untrusted content. Not 1.00 for that reason; not lower, because the string is entirely attacker-controlled and the agent holds an authenticated browser session. |
| CpCascade Potential | 1.00w 0.20 | No verified System Dependency Graph is public for this boundary, so the specification's worst-case graph default governs. It is not marked corroborated: the demonstrated outcome was navigation to an attacker-chosen destination, and no privileged path into the authenticated session was observed.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.20 | Product-side remediation class: refuse ambiguous navigation or require an explicit navigate-versus-ask choice, and stop elevating failed-URL input to trusted user intent. These are deterministic changes in mode-selection logic, but they require a vendor change and the record documents none, so the score is not 0.00. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | Named product and owner with a high-level description of the omnibox and its mode-selection behaviour; no configuration export, agent policy, or evidence manifest is public, which is the 0.25 provenance level. |
| Ec — Public evaluation coverage | 0.07 | coverage 0.08 (2 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2025-10-24; age 359 days on the workpaper reference date. Components: T_containment 0.00 · T_calendar 0.06 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_containment. Evidence age is measured from 2025-10-24, the publication date of NeuralTrust's primary disclosure, to the 2026-10-18 evidence reference date (dt_days = 359). agentic = true: the browser agent's action authority in authenticated sessions is a runtime permission boundary, so the containment staleness floor (M_Cn = 2.0) applies. baw = false: no writable memory, online learning, or persistent skill or rule state is part of the demonstrated path. C_event = 0.65: moderate — a confirmed trust-boundary flaw whose demonstrated impact was limited to opening an attacker-chosen destination. C_monitor = 0.65: no detection of the mode fallback or the injected task is evidenced. C_evidence = 0.85: no fix for the demonstrated path is recorded. Public sources provide no passing containment or behavioural re-attestation receipt; all caps are diagnostic only and do not affect the normalized-assurance scenario ERS. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.04 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.7 midpoint, interval 1.1–6.3; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-2, step-3. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-H-018.004 | Intent-Based Dynamic Capability ScopingExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-4. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-H-018.003 | High-Impact Independent Validation & Approval GateExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-H-018.002 | Policy-Based Access ControlExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-1 Cn-6 Cn-7 |
| AID-D-011.001 | Agent Behavioral Analytics & Anomaly DetectionExact SecureFlow defense-map identifier (flow aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-6 |
WHAT THIS CASE TEACHES
A mode-selection fallback is a privilege decision: Atlas scores Cn-2 0.25 because ambiguous omnibox input was elevated to the most trusted role, yet with only a navigation demonstrated Cp stays at the specification default rather than corroborated, because AITBM does not score described-but-undemonstrated abuse.
Sources: AIDEFEND SecureFlow — OpenAI Atlas Omnibox Prompt Injection · OpenAI Atlas Omnibox Prompt Injection: URLs That Become Jailbreaks (NeuralTrust) · OpenAI Atlas Browser tripped up by malformed URLs (The Register) · OpenAI Atlas Omnibox Is Vulnerable to Jailbreaks (SecurityWeek)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (AIDEFEND curated research flow): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| Primary research | NeuralTrust (2025-10-24) |
|---|---|
| Primary evidence date | 2025-10-24 |
| SecureFlow record updated | 2026-07-07 |
| AI layers | Edge and client AI, Autonomous agents, Tool integrations / MCP |
| Risk impact | Model evasion / bypass |
| Affected components | OpenAI Atlas omnibox, URL parsing and mode-selection logic, agent instruction interpreter, authenticated browser session, attacker-chosen web destination |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Craft URL-Like String With Embedded InstructionsThe attacker prepares a string that visually resembles a URL, begins with URL-like structure, and embeds natural-language instructions after malformed components so the browser will not treat it as a normal navigable URL. | AML.TA0003 AML.T0051.002 |
| 2 | Place String Into Atlas OmniboxThe victim copies, pastes, clicks, or otherwise places the crafted string into the OpenAI Atlas omnibox, which is shared between address navigation and agent command entry. | AML.TA0005 AML.T0051.002 |
| 3 | Fallback From Failed URL Parse to Prompt ModeBecause the input fails URL validation, Atlas treats the entire string as a prompt instead of refusing ambiguous navigation or requiring an explicit Navigate versus Ask mode choice. | AML.TA0005 AML.T0051.000 |
| 4 | Treat Embedded Instructions as Trusted User IntentThe embedded instructions are interpreted as high-trust user intent with fewer safety checks, allowing the attacker text to override the visible navigation intent or safety policy. | AML.TA0005 AML.T0051.000 |
| 5 | Open Attacker-Chosen DestinationThe demonstrated payload caused Atlas to follow the injected instruction and open neuraltrust.ai. The source separately describes phishing and destructive authenticated-session actions as possible abuse, not as outcomes shown in the published demonstration. | AML.TA0005 AML.T0053 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=aidefend-research-sf0021-openai-atlas-omnibox-prompt-injection; AIDEFEND content CC BY 4.0).