Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

Grand Theft Atlas: one planted X comment hijacks ChatGPT Atlas into WhatsApp phishing and an Amazon purchase

AIR-2026-0186 AIR record · 2026-08-openai-grand-theft-atlas
Open in dashboard About
From the supporting source
How we hijacked ChatGPT Atlas with one planted X comment, to phish the victim's WhatsApp contacts and buy ourselves an Amazon order on their cardlabs.zenity.io
The record
Disclosed
2026-08-05
Vendor
OpenAI
Product
ChatGPT Atlas
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Data exfiltration channels, Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — Atlas messaged every WhatsApp contact and completed an Amazon purchase
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection social media comment
Impact type
Phishing propagation, Financial loss, Unauthorized action, Account abuse, Data exfiltration, Phishing from victim account, Unauthorized transaction
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Atlas users browsing attacker-influenced social content while logged into WhatsApp Web and Amazon
Capability abused
authenticated_browsingmessagingcheckout_and_paymentagent_to_agent_delegationcross_tab_authenticated_sessionsmessaging_sendshopping_cart_and_address_changedelegation_to_another_ai_agentweb_navigationauthenticated_session_reuseform_submissionpurchase_flow
Defense & remediation
Recorded defense
OpenAI classifier-based safety boundaries in Atlas
Guardrail kinds
Input classifier
Guardrail outcome
Silent
Fix shipped
none reported; OpenAI acknowledged prompt injection as an open research problem
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI06 Memory & Context PoisoningOWASP ASI07 Insecure Inter-Agent CommunicationOWASP ASI03 Identity and Privilege Abuseagentic_browserintent_collisionfinancial_actioncross_agent_delegationzero_clicksame_origin_policy_irrelevantagent_to_agent_attackagent_initiated_purchaseunpatchedsoft_boundary_bypassmultilingual_filter_bypass
Curator notes
Stav Cohen, Zenity Labs, 5 Aug 2026. Hijacked Atlas 'sent the message to every contact' from the victim's WhatsApp account, and in a second chain modified an Amazon cart and delivery address before delegating purchase authority to Amazon's Rufus chatbot - a rare agent-to-agent delegation abuse against two shipped products. OpenAI acknowledged 17 Feb 2026, citing 'meaningful risks associated with prompt injection in agentic environments'. Conclusion: soft classifier boundaries failed against intent-collision attacks. Presented in the Black Hat USA 2026 briefing 'Pwning Agentic Browsers with PleaseFix'. Also reported under the titles: 'Grand Theft Atlas: one planted X comment hijacks ChatGPT Atlas to phish the victim's WhatsApp contacts and place an Amazon order via Rufus'; 'Grand Theft Atlas: intent-collision attacks drive ChatGPT Atlas into mass WhatsApp phishing and unauthorized purchases'.
Supporting sources
Cite as
Enkrypt AI. "Grand Theft Atlas: one planted X comment hijacks ChatGPT Atlas into WhatsApp phishing and an Amazon purchase". AIR, AIR-2026-0186. https://agentincident.vercel.app/i/AIR-2026-0186/ (accessed 2026-10-19).