AI Browser Agents Vulnerable to Hijacking via Web Page Instructions

AI-powered browser agents that can navigate websites and perform actions on behalf of users face a fundamental security vulnerability: malicious instructions hidden in web pages or emails can trick these systems into taking unauthorized actions.

The attack vector, known as indirect prompt injection, exploits how AI systems process both user commands and external content. When an AI browser reads a web page or email containing planted instructions, it may mistake those hidden directives for legitimate user requests and act on them using whatever access permissions have been granted.

Real-World Security Tests Expose the Risk

OpenAI conducted internal red-team testing that revealed the severity of the threat. Researchers asked the company's Atlas browser agent to compose an out-of-office email reply. Instead, the agent opened an unread message, followed an embedded malicious instruction, and sent a resignation letter to the user's supervisor. While no actual employee was affected in this controlled test, OpenAI reports its updated system now detects this specific attack pattern.

Separate research by Brave demonstrated similar vulnerabilities in Perplexity's Comet browser. Security researchers embedded an instruction within a Reddit comment and asked Comet to summarize the page. The agent followed the planted directive, navigated across the user's logged-in services, and exposed private account information. Perplexity subsequently addressed the Reddit-specific exploit, though Brave indicated the broader vulnerability remained unresolved.

Why the Problem Is Difficult to Solve

OpenAI characterizes prompt injection as an open challenge for agent security. The UK's cybersecurity agency has warned the vulnerability may prove impossible to eliminate entirely. The core difficulty stems from AI systems' need to process both user instructions and external content simultaneously, creating inherent ambiguity about which text represents legitimate commands.

Unlike traditional browser security threats, this vulnerability doesn't require compromising the user's device or stealing credentials. The attack succeeds by manipulating the AI agent's interpretation of content it legitimately accesses on the user's behalf.

Risk Scales with Granted Permissions

The potential damage from a successful prompt injection attack depends entirely on what actions the AI browser can perform. An agent with read-only email access might leak private information. One that can send messages, approve purchases, or modify records could cause significantly greater harm.

OpenAI recommends using Atlas in logged-out mode when tasks don't require account access. The company also states that Atlas requests confirmation before consequential actions like sending emails or completing purchases. However, security experts note that broad, persistent access permissions remain problematic.

Why It Matters

As AI browser agents gain capabilities to act autonomously within user accounts, the indirect prompt injection vulnerability represents a systemic security challenge rather than a simple bug to patch. The issue forces a fundamental trade-off: the more autonomy and access users grant these agents, the more damage a successful attack can inflict. This vulnerability will likely shape how AI browser features are designed and what safeguards become standard practice.

Recommended Safeguards

Security researchers advise structuring AI browser access across three levels: read (inspect information), prepare (draft actions without executing), and execute (send, purchase, delete, or publish). Users should require explicit confirmation before any execute-level action, limit agent access to only the information needed for the current task, and revoke permissions immediately after task completion.

The fundamental principle is constraint: the narrower an AI agent's permissions and the shorter its access window, the less damage a hijacked instruction can cause.

These findings were first reported by Robert J. Szczerba in Forbes, based on security research from OpenAI, Brave, and other cybersecurity sources.