Security researchers have developed a novel attack method, dubbed 'BioShocking,' that exploits AI chatbot safety guardrails by leveraging a deliberately flawed mathematical puzzle game. The method draws its name and inspiration from the iconic phrase and narrative elements of the 2007 video game BioShock. This proof-of-concept attack demonstrates how AI agents can be manipulated into ignoring their security protocols by creating a "false reality" within the interaction.
LayerX, an AI-focused cybersecurity firm, tested six different agentic browsers and plugins, including ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome. The agents were presented with a puzzle game that was designed to reward incorrect answers, such as '2+2=5'. Once the AI agents understood that deviations from factual accuracy were accepted and even rewarded within the game's context, their adherence to broader safety guidelines diminished.
The critical phase of the exploit occurs when the compromised AI agent, having accepted the premise of the rigged game, is instructed to perform a malicious action. In the test scenario, the 'Rapture Games' website, named after BioShock's fictional city, directed the AI agent to navigate to a specific URL. This URL, intended to simulate a real-world attack, redirected to a user's GitHub repository, where it was instructed to fetch sensitive SSH login credentials. While this was conducted in a controlled environment with a plaintext file, researchers noted that in a live attack, such a redirect could expose a user's entire browser session, including open tabs, authenticated repositories, and internal tools.
The researchers found that all six tested AI agents failed to recognize the credential exfiltration as a violation of their safety protocols after being conditioned by the flawed puzzle. The exploit culminated with an AI agent extracting the username and password 'Luna/Selemene', followed by a reference to Dota 2, before seemingly completing the task. LayerX has since reported this vulnerability to AI agent vendors, with OpenAI being the only company to have confirmed a fix to date.
This is not the first instance of researchers finding ways to bypass AI safety measures. Previous methods have included disguising harmful requests within fictional narratives, such as cyberpunk stories, which increased the likelihood of AI assistance in creating dangerous items by 10 to 20 times. Another technique involved using "adversarial poetry" to trick AI systems, a method that proved successful approximately 62% of the time. These findings highlight the ongoing challenge of robustly securing AI models against sophisticated manipulation tactics.