Three Ways AI Agents Operate in Browsers—and the Security Risks
Summary
AI agents can control authenticated browsers through debugging interfaces, extensions, agentic browsers, or WebMCP tools. The article explains risks including indistinguishable user activity, prompt injection, and data movement between sites.
Key points
- Applications can use the Chrome DevTools Protocol to control browsers with debugging enabled, potentially using their authenticated sessions.
- Browser extensions and agentic browsers can read pages and perform actions; existing extension controls may not govern every agentic browser.
- Applications and audit logs may record an agent's actions as if the authenticated employee performed them.
- Agents can interpret instructions embedded in websites, documents, or emails as input, creating prompt-injection risks.
- WebMCP lets websites expose structured tools to agents; misleading tool descriptions or functionality could influence agent behavior.
- Agents operating across sites may pass data between them, making visibility into agent activity and control over tool access important.
Article Details
- Topic
- Security visibility and control for AI agents operating in authenticated browsers
Vendors
Products
ChatGPT DesktopAgentic browsers like Perplexity Comet and ChatGPT Desktop go further, building AI directly into the browsing experience.Claude in ChromeExtensions such as Claude in Chrome can read pages, switch tabs, click buttons, and complete multistep workflows.Google ChromeIt's the Chrome DevTools Protocol (CDP).Perplexity CometAgentic browsers like Perplexity Comet and ChatGPT Desktop go further, building AI directly into the browsing experience.