When Browsers Place Orders for You: Assistant or Hitman?

Last week, a grad student in the lab ran a RAG retrieval experiment and mixed some text with malicious instructions into the knowledge base. The model obediently followed them. At the time, I thought this was just a classic case of prompt injection—fixing a filter rule would solve it. It wasn't until yesterday, when I saw Zenity's test report on the OpenAI Atlas browser, that I realized I had underestimated the problem.