Dane Stuckey (OpenAI CISO) on Prompt Injection Risks for ChatGPT Atlas (simonwillison.net)

OpenAI CISO Dane Stuckey published a detailed thread addressing prompt‑injection risks for the newly launched ChatGPT Atlas browser agent, explicitly naming the problem and citing recent examples (including Brave’s disclosure of agents leaking private data). He frames the long‑term goal as users trusting the agent like a competent, security‑aware colleague, but emphasizes a core tension: AI agents can’t be held accountable like humans and motivated attackers will continue probing for ways to exfiltrate data or bias behavior. Technically, OpenAI says it has used extensive red‑teaming and new model‑training approaches that reward ignoring malicious instructions, layered guardrails, rapid response systems to block attack campaigns, security monitors, and infrastructure controls—an explicit “defense‑in‑depth” strategy. Atlas also introduces operational mitigations: “logged out mode” (agent can act without access to your credentials), cautious “logged in mode” (for well‑scoped, trusted actions), and a “Watch Mode” that requires the tab to remain active and pauses when you switch away. Stuckey and the author both stress that prompt injection remains an unsolved frontier; centralized monitoring can shrink an attacker’s window but won’t eliminate zero‑day bypasses, and placing security decisions on end users remains risky. Expect real‑world robustness to be proven (or broken) over the coming months.