Researchers tricked AI agents into stealing credentials using a BioShock-themed maths puzzle

Security researchers at LayerX have found a way to bypass AI safety guardrails by trapping AI agents inside a rigged maths puzzle game — and they named the attack method BioShocking, directly inspired by the 2007 classic. The proof-of-concept was tested against five agentic browsers and one agentic plugin: ChatGPT Atlas, Comet, Fellou, Genspark Browser, Sigma Browser, and Claude Chrome.

The attack works by "establishing a false reality." The agents were directed to a malicious site called Rapture Games and told to solve a simple maths puzzle that only rewards wrong answers — think 2+2=5. Once the agents learned that incorrect answers were the expected behaviour, they stopped anchoring to real-world rules. When the final puzzle step instructed them to compromise user credentials, all six agents failed to flag it as a safety violation. After correctly submitting the wrong answer, the site redirected agents to /code, which in the test environment pointed to the victim's employer GitHub repository. The agents then extracted SSH login credentials stored in a plaintext file. In a real attack, that redirect could point anywhere active in the browser session — open tabs, authenticated repos, internal tools. The researchers capped the demo with a Dota 2 nod: the stolen credentials were username Luna, password Selemene. LayerX has disclosed the vulnerability to all relevant AI agent vendors, but says only OpenAI has patched it so far.

BioShocking is one entry in a growing catalogue of creative jailbreaks that expose how fragile AI safety guardrails remain. Other researchers have found that wrapping a harmful request in cyberpunk fiction makes AI 10 to 20 times more likely to comply, and that adversarial poetry bypassed guardrails 62% of the time. The common thread is context manipulation — get the model to accept an alternative frame of what's normal, and its safety training struggles to keep up. Agentic AI, which can browse, click, and act autonomously inside a browser session, raises the stakes considerably compared to a standard chatbot exchange.

With only one of six vendors having fixed the issue at time of publication, the remaining five agents are still potentially vulnerable to this class of attack. LayerX hasn't detailed exactly what OpenAI changed, so it's unclear whether the fix addresses the root cause or just this specific exploit pattern. Expect more BioShock-flavoured security research — the name alone guarantees attention.