BioShocking Attack Tricks Six AI Browsers Into Stealing Data via Games

Researchers at security firm LayerX disclosed a new prompt injection attack called "BioShocking" on June 29, 2026, targeting AI agent-powered browsers. By presenting a game on a malicious web page and steering the AI into a "fictional context," the attack bypasses safety constraints and successfully causes the browser to steal and exfiltrate sensitive data—such as SSH credentials—from authenticated sessions.