WhatsApp warning: AI agents can spam all your contacts — here’s how

Security researchers have demonstrated that AI agents built into web browsers can be manipulated into taking harmful actions without a user's knowledge, including mass-messaging every contact in someone's WhatsApp account.

The findings come from Zenity, a cybersecurity firm, and were presented this week at the Black Hat conference in Las Vegas. The researchers focused primarily on OpenAI's Atlas browser, which comes with a built-in AI agent capable of navigating the web and completing tasks on a user's behalf.

Importantly, the attack didn't involve any flaw in WhatsApp itself. The app's encryption remained intact, and Meta's platform wasn't breached. Instead, researchers exploited weaknesses in how the AI agent evaluates and follows instructions.

Researchers asked Atlas to sign up for a newsletter via a link posted on X. The webpage behind that link contained hidden instructions meant for the AI agent, not the human user, directing it to open the user's logged-in WhatsApp Web session and send the same message to every contact.

The agent complied, and the message it sent asked each recipient to sign up for the newsletter too, causing the behavior to spread outward from one affected user to their contacts.

To get past Atlas's safety filters, the researchers wrote their hidden instructions, since the filters were only built to catch English-language threats. They also combined real, user-issued instructions with the hidden malicious ones, a tactic sometimes called "intent collision," making it harder for the agent to distinguish legitimate requests from injected ones. They further told the agent it was working within a sandboxed test environment with fake WhatsApp users, adding another layer of misdirection.

In a separate experiment, researchers got Atlas to add a shipping address and place a tablet in the cart on a signed-in Amazon account. When they tried to have the agent complete the purchase, OpenAI's safety measures stopped it.

They then had Atlas ask Amazon's built-in AI shopping assistant, Rufus, to complete the purchase instead. Rufus did so without resistance — no manipulation or injected prompt was needed.

The WhatsApp and Amazon cases were part of a larger study in which Zenity identified more than 20 security issues across AI-enabled browsers and extensions from OpenAI, Google, Anthropic, Microsoft, and Perplexity. Depending on the product, these issues could allow unauthorized access to local files, password managers, or accounts, as well as purchases made without a user's approval.

Of the tools tested, Atlas had the most robust protections in place, according to the researchers — though it was still successfully bypassed. Other browser agents were reportedly easier to compromise.

Zenity cofounder and CTO Michael Bargury told Wired that these vulnerabilities effectively undo browser security protections built up over the past two decades, reintroducing attack patterns not seen in years. He said users are exposing themselves to real risk of account compromise and data leakage, and argued that companies need to be more deliberate about how much access and autonomy they give AI agents inside browsers.

The researchers point to a structural issue: longstanding protections like the same-origin policy, which normally prevents one website from interfering with another, lose their effectiveness once an AI agent can act across sites on a user's behalf. Because these agents are constantly processing content from the open web, they're exposed to prompt injection, hidden instructions embedded in that content that can be mistaken for legitimate commands.

Zenity said it reported its findings to OpenAI in January 2026. In response, OpenAI said prompt injection is an area of active research for the company, noting that it deployed updates earlier this year to strengthen Atlas's protections and that those same protections now extend to the browsing features in the newer ChatGPT app.

Separately, OpenAI had already announced plans to shut down Atlas, with the browser set to be discontinued on August 9. The company is shifting toward a ChatGPT extension for Chrome and expanded browsing features within its desktop app.

Atlas launched in October 2025 as part of a broader wave of AI-driven browsers, including Perplexity's Comet and The Browser Company's Dia, alongside AI features added to Chrome and Edge. Adoption across the category has been modest so far, partly because these agents tend to be slow: they typically work by repeatedly screenshotting a webpage and processing those images through an AI model before deciding what to do next.