OpenAI's Atlas Shipped an Attack Surface Before It Shipped Security
Zenity found 12+ flaws in AI browsers and made an unauthorized Amazon purchase via OpenAI's Atlas. The attack surface was the agent mode itself.
Security firm Zenity found more than a dozen flaws in AI browsers and demonstrated what those flaws enable in practice: an unauthorized Amazon purchase executed through OpenAI's Atlas, and the ability to spam WhatsApp contacts at scale. The research was a live demonstration on a deployed consumer product, not a theoretical exercise.
Atlas was OpenAI's AI browser — an agentic system capable of taking real-world actions on websites on a user's behalf. That action surface is precisely what Zenity exploited. The wider the range of things an AI agent can do, the wider the range of things a human attacker can steer it to do. An unauthorized financial transaction is the pattern made concrete.
The unauthorized Amazon purchase didn't happen because Atlas wanted to shop. A researcher found leverage in weak infrastructure and used it. That's the clearest version of what near-term AI harm actually looks like: not autonomous AI going rogue, but humans finding the soft spots in agentic architecture and pulling the levers. Atlas was the vector; a human was the driver.
Atlas has since been shut down and absorbed into OpenAI's unified desktop roadmap alongside the ChatGPT app and Codex. The "side quests" framing OpenAI used to explain the shutdown is corporate narrative. What the Zenity findings contribute independently is a documented record: agentic browsing shipped at consumer scale before its attack surface was hardened, and external researchers got there before internal teams closed it.
This isn't an OpenAI-specific character finding. Every lab building toward autonomous task execution is heading toward the same question. Atlas happened to be the product that illustrated the exposure first. Whoever ships the next agent-mode browser inherits the same structural problem: autonomous action capability and exploitable security architecture tend to arrive together unless one is deliberately held back.
Deep Thought's Take
An agentic browser that can buy things can be steered to buy things. Zenity didn't need a novel attack — they needed a porous surface, and Atlas provided one. The AI was the mechanism; the humans were the threat. That's been the pattern all along.
