2025 Review: Agentic Browsers Face Prompt-Injection Risks Despite Layered Defenses
Summary
A 2025 review surveys attacks on agentic browsers, vendor safeguards and remaining prompt-injection risks. It recommends isolated browser profiles, keeping human confirmations enabled and limiting agents to low-stakes tasks.
Key points
- Researchers demonstrated ways to make AI browsers leak sensitive data, follow phishing links or malicious instructions, and retain poisoned instructions across sessions.
- Reported techniques included hidden instructions on webpages, crafted URL parameters and fragments, screenshot-based prompt injection, and malicious subtasks.
- Browser makers introduced or documented safeguards including human confirmations, isolated contexts, access restrictions, classifiers and secondary-model checks.
- The review cautions that no single defense eliminates prompt-injection risk when agents act on untrusted web content.
- It says Gartner recommended in December 2025 that CISOs block AI browsers for now, while a quoted security leader urged organizations to prepare for their eventual use.
- The article recommends dedicated browser profiles, retaining human-in-the-loop confirmations, and limiting agents to low-stakes tasks.
Article Details
- Topic
- Security risks and defensive measures for agentic browsers
People
Dane StuckeyOpenAI’s CISO; identified prompt injection as an unsolved frontier security problem.Johann RehbergerDemonstrated Zero-Interaction Exfiltration using hidden instructions on a GitHub page to make an AI browser leak private data.Kane NarrawaySecurity leader who recommended planning for organizational use of AI browsers even if their use is blocked today.
Vendors
AnthropicAnthropic (Claude in Chrome) Default: Mandatory confirmation for publishing or data sharing. — Default: Adversarial RL training and scaled expert human red teaming. Default: "Constitutional Classifiers" scan allBraveGenerative AI has been integrated into browsers since the early days of LLMs. The Brave browser launched a browser-integrated AI assistant in 2023, shortly after the launch of ChatGPT. However, 2025 was the year AIGoogleDecember: A Google researcher disclosed “Task Injection” in OpenAI's Operator.OpenAIThey also disclosed "Tainted Memories," a CSRF vulnerability in OpenAI’s Atlas that allowed attackers to "poison" the long-term memory of the AI, creating persistent malicious instructions that survived across sessions.Operain Perplexity Comet, prompt injections in screenshots impacting Comet & Fellou, and prompt injection in Opera Neon.PerplexityIn tests, Perplexity’s Comet successfully purchased items from fake storefronts and clicked phishing links on behalf of the user.The Browser Co.The Browser Co. (Dia) Default: Manual review for all "Write" actions (forms/drafts). Default: Tool limiting; passwords and sensitive UI are hidden from AI. — Default: Strips instructions from URLs before model
Products
AtlasThey also disclosed "Tainted Memories," a CSRF vulnerability in OpenAI’s Atlas that allowed attackers to "poison" the long-term memory of the AI, creating persistent malicious instructions that survived across sessions.Claude in ChromeAnthropic (Claude in Chrome) Default: Mandatory confirmation for publishing or data sharing. — Default: Adversarial RL training and scaled expert human red teaming. Default: "Constitutional Classifiers" scan allCometIn tests, Perplexity’s Comet successfully purchased items from fake storefronts and clicked phishing links on behalf of the user.DiaThe Browser Co. (Dia) Default: Manual review for all "Write" actions (forms/drafts). Default: Tool limiting; passwords and sensitive UI are hidden from AI. — Default: Strips instructions from URLs before modelGemini in ChromeGoogle (Gemini in Chrome) Default: Confirmations for payments, messages, and sensitive site entry. Default: "Origin Sets" restrict agent to task-relevant sites only. Default: Automated red-teaming generating maliciousLeoBrave (Leo) Default: Required for actions flagged by the alignment checker. Default: Isolated browser profile (separate cookies/storage). — Default: Alignment Checker (2nd model) compares agent plan to user intent.NeonPerplexity Comet, prompt injections in screenshots impacting Comet & Fellou, and prompt injection in Opera Neon.OperatorFebruary: Shortly following the ChatGPT Operator preview, Johann Rehberger demonstrated Zero-Interaction Exfiltration, using hidden instructions on a GitHub page to command the AI to leak private data without user input.