OpenAI CISO Dane Stuckey outlines prompt injection mitigations in ChatGPT Atlas, including a “logged out mode” that blocks agent access to user credentials

Yesterday we launched ChatGPT Atlas, our new web browser. In Atlas, ChatGPT agent can get things done for you. We're excited to see how this feature makes work and day-to-day life more efficient and effective for people. ChatGPT agent is powerful and helpful, and designed to be

@cryps1s 2025-10-23 Dane Stuckey

Context & Ripple Effects

Atlas launched with an agent mode for automating web tasks, extending ChatGPT from answering questions into acting across browser sessions. OpenAI had already described red-team-driven controls for its broader agent system, including watch-mode and terminal restrictions.

The logged-out mode makes credential exposure a first-class constraint in Atlas’s design: an agent that encounters untrusted web content is deliberately separated from a user’s authenticated accounts.

First-order effects

Atlas users can invoke an agent configuration that blocks access to their credentials, reducing the damage prompt injection could cause within authenticated web sessions.
OpenAI must present agent automation as a set of permission and session-boundary choices, rather than as unrestricted browser control.

Second-order effects

The safeguard creates a practical trade-off for users: tasks requiring account access may remain more exposed than tasks that can be completed while logged out.
Rival browser-agent products will face pressure to make credential isolation, explicit modes, and other prompt-injection controls legible to users rather than treating them as back-end protections.

Third-order effects

If agentic browsing becomes a durable interface, browser security will increasingly center on constraining what an agent may access and do after it reads untrusted content—an expanding attack surface that early reviewers flagged.
The effectiveness of these boundaries will shape whether users delegate consequential web tasks to agents; technical mitigations alone may not resolve the usability-security trade-off.

The trend: Agentic browsers are turning prompt injection from a model-safety concern into an access-control problem spanning web content, credentials, and delegated actions.

Discussion

@emilyforlini Emily Forlini on x
OpenAI employee says the new Atlas AI browser “can still make...mistakes, like trying to buy the wrong product or forgetting to check-in with you before taking an important action.” No thanks!
@pelaseyed @pelaseyed on x
OpenAI basically admitting that Atlas is insecure right after asking permissions to your Keychain
@morqon Morgan on x
the deployment part of “research and deployment” is about helping society to adapt, including how we mitigate new risks [image]
@spoonedher @spoonedher on x
people like @elder_plinius are going to start being offered millions of dollars to stress test models for new environments, i think weirdly enough the next 10 years are going to see a huge boom in intellectual labor demand opposed to a contraction in it
@cyberqueenmara MaraJade on x
“Our long-term goal is that you should be able to trust ChatGPT agent to use your browser, the same way you'd trust your most competent, trustworthy, and security-aware colleague or friend.” I've vetted my friend over decades and I know my friend doesn't have an ulterior motive.
@daniel_mac8 Dan Mac on x
Sounds like most of he risks associated with Atlas are related to using the agent? So if you want to be a secure Atlas enjoyoor, simply don't use the agent?
@jaredrhizor Jared Rhizor on x
The transparency is nice, but it seems irresponsible for OpenAI to encourage people to use an AI web browser with a fundamental “unsolved security problem”.
@talbeerysec Tal Be'ery on x
prompt injections, the final frontier [image]
@marktenenholtz Mark Tenenholtz on x
Big respect to @OpenAI for sharing this, not everyone appreciates how much work goes into this
@simonwillison.net Simon Willison on bluesky
OpenAI's CISO Dane Stuckey posted an essay (on Twitter) about how their new ChatGPT Atlas browser attempts to deal with the risk of prompt injection attacks, I ended up writing a point-by-point commentary on my blog: simonwillison.net/2025/Oct/22/ ...

Chronicles