OpenAI Atlas AI Browser Security Patch Fixes Zero-Click Email Prompt Injection

OpenAI has deployed an urgent security patch for its experimental **Atlas** agentic browser following disclosures of a zero-click prompt injection vulnerability. Researchers demonstrated that malformed HTML strings embedded in incoming emails could trick the browser's autonomous agent into executing unauthorized file downloads. The update introduces strict context isolation between web content parsing engines and tool execution modules, preventing untrusted DOM text from issuing CLI commands.

Security experts emphasize that robust input sanitization remains the paramount challenge for agentic web browsers operating with system-level privileges.