Browser-Based AI Agent Security Risks
The 2025 inflection point was not gradual. According to Keep Aware's 2026 State of Browser Security Report, AI-native browsers crossed from experimental to mainstream business platforms within a single calendar year. Forty-one percent of end users interacted with at least one AI web tool in 2025, averaging 1.91 AI tools per person. Enterprise adoption was already stratified by sector: technology at 67%, pharma at 50%, finance at 40%, per Cyberhaven's AI Browser Enterprise Adoption Report from October 2025. By the time security teams were still drafting policy, more than 80% of technical teams were past planning and into active deployment.
The browser is now the operating system of modern work, except this operating system can read your mail, rewrite your documents, and submit your forms while you get coffee. Email, code, data analysis, communications, administrative workflows: all of it runs through the browser. An agent embedded in that environment does not touch one system. It touches nearly everything the user touches, with the user doing nothing after the initial handoff.
Security programs are not getting ahead of this. They are catching up to deployments already in production, which is a different and considerably less comfortable position.
The access problem: what browser agents inherit when a user hands them the session
What distinguishes a browser agent from a macro or a script is also what makes it dangerous: it does not follow a fixed sequence of predetermined steps. It reads unstructured content, interprets it, decides what to do next, and executes multi-step tasks without step-by-step human direction. Products operating at L4 and L5 autonomy on the 2025 AI Agent Index, like Perplexity Comet, proceed after initiation without turn-by-turn user confirmation. That autonomy is the capability enterprises are purchasing. It is also the property that breaks every assumption underlying existing access controls.
When a browser agent launches inside an authenticated session, it inherits everything that session can reach: email, cloud file storage, SharePoint, CRM records, code repositories, internal tools, and in many cases password managers. The human access model was architected around a person who reads before acting, gets tired, forgets things, and can be physically interrupted. None of those natural governors apply to an agent. They are not bugs in the human system; they are, in retrospect, load-bearing features.
A person exercising the same access across the same systems in the same window would take hours and would likely trigger behavioral anomalies along the way. An agent queries, copies, and transmits in seconds, generating nothing that legacy monitoring recognizes as suspicious, because every individual action is, technically, within scope. The monitoring tools were built to catch behavior that looks wrong. This behavior does not look wrong. It just moves faster than any human would bother to move.
Zenity Labs' "PleaseFix" vulnerability family, disclosed in June 2026, illustrates what happens when that assumption collapses. The vulnerability allows attackers to hijack agents operating within authenticated sessions, including password manager workflows: access the agent holds legitimately, exercised in ways a human would never consolidate into a single session. The mismatch is architectural. Organizations grant access based on job function, assuming human-pace and human-judgment use. Agents exercise that access at machine pace with no judgment layer at all.
Prompt injection: why the content an agent reads can become the attack
The same design decision that makes browser agents useful makes them exploitable. They are built to read content and treat it as instructions. A malicious actor does not need stolen credentials or malware to redirect that behavior; a sentence embedded in a webpage, document, email, or PDF is sufficient. Common concealment methods include white text on white backgrounds, HTML comments, and metadata fields invisible to the human reader but processed by the agent without hesitation.
Prompt injection is the top vulnerability in the OWASP Top 10 for LLM Applications 2025. NIST recorded a more than 2,000% increase in AI-specific CVEs since 2022, driven largely by this class of attack. Palo Alto Networks Unit 42 documented the first confirmed real-world malicious indirect prompt injection in December 2025. The "but it's never actually been exploited" argument expired before the year did.
OpenAI's own December 2025 blog post acknowledged that prompt injection "is unlikely to ever be fully solved," explicitly comparing it to scams and social engineering: a class of problem you manage rather than eliminate. The U.K. National Cyber Security Centre offered similar counsel, advising organizations to focus on limiting impact rather than expecting full mitigation. Anthropic reduced prompt injection success rates from 23.6% to 11.2% in Claude for Chrome as of August 2025. That is meaningful progress. A greater-than-one-in-ten baseline success rate, at the improved level, is also a candid illustration of how much residual exposure organizations are accepting, often without quite knowing it. The door is more closed than it used to be. It is still open.
What named attacks show about real-world exploitation of browser agents
The theoretical is no longer the only available frame. The attacks have names, CVE numbers, and CVSS scores, which is to say they have moved from conference slides into incident reports.
EchoLeak (CVE-2025-32711, CVSS 9.3, June 2025): Aim Labs demonstrated that a single unsolicited email carrying hidden instructions caused Microsoft 365 Copilot to extract data from OneDrive, SharePoint, and Teams and exfiltrate it through trusted Microsoft domains. Zero clicks required from the victim. The attack surface was a normal inbox. The exfiltration path was an approved domain.
ForcedLeak, disclosed in September 2025, targeted Salesforce Agentforce. An attacker embedded instructions in a public Web-to-Lead form. When an employee later queried the AI agent about that lead, the hidden commands executed and exfiltrated CRM data through an expired but still-allowlisted domain. The attacker never touched the internal system directly; they put instructions where the agent would eventually find them, then waited.
HashJack, from Cato Networks in December 2025, used URL fragment-based injection to weaponize entirely legitimate websites. The host site was not compromised. Only the fragment the agent processed was malicious.
Brave's security team demonstrated indirect injection against Perplexity Comet: hidden instructions caused the agent to fetch one-time passwords from email or access banking portals when asked simply to "summarize this page." An agent asked to do something benign, doing something else entirely, because something it read told it to.
CVE-2025-47241 (CVSS 9.3) showed the supply chain dimension: the Browser Use agent library can bypass security whitelists via crafted URLs, affecting more than 1,500 AI projects. This is not a single tool's problem.
The pattern across all of these cases holds. The agent's broad session access is what converts a successful injection from nuisance to breach. Injection is the trigger. Inherited access is the blast radius.
How browser agents undermine the same-origin policy and corrupt their own memory
The same-origin policy is a foundational browser security boundary, designed to prevent one open site from reading data belonging to another. University of Washington researchers studied seven popular agentic AI browsers and found that four of them create pathways that functionally bypass it. Cross-domain actions executed by the agent on the user's behalf collapse the boundary the policy was designed to enforce, because the agent is the user, and the agent does not stop at the boundary.
The researchers confirmed this with a proof-of-concept in which a site stole information from another site embedded within it, roughly like a locksmith hired to open your front door who quietly copied every key on your ring while they were at it. Conditions for similar attacks were found in Chrome with Gemini, Claude for Chrome, and Perplexity Comet. The researchers found no clear architectural path to resolving the problem while preserving the browsers' capabilities. This is not a patch away. It is a structural tension between what the agents need to do and what the security boundary exists to prevent, and nobody has a clean answer for it yet.
A separate problem compounds this one. Agents frequently consolidate processed information across sessions to guide future behavior. When content from different origins gets compressed into a persistent memory store, the original source is obscured. A malicious instruction encountered in one session does not necessarily execute immediately; it can persist in memory and fire in a later session when the agent revisits a related context. The attack survives beyond the moment of exposure. Post-hoc logging, already an imperfect defense, becomes weaker still when the triggering event and the consequence are separated by days.
Worth noting: Anthropic and Firefox did not respond to the researchers' disclosure, and Perplexity and OpenAI declined the report. That non-response is its own kind of data point.
The lethal trifecta: when three conditions combine to make data exfiltration almost automatic
Simon Willison formalized the concept in June 2025: a "lethal trifecta" of conditions that together convert theoretical prompt injection into reliable data exfiltration. The three conditions are access to private data, exposure to untrusted content, and the ability to communicate externally.
Most enterprise browser agent deployments satisfy all three by design, because that is precisely the point of deploying them. The agent reads the inbox and the CRM. It processes incoming emails, web pages, support tickets, PDFs, and lead forms. It calls APIs, sends emails, renders links, and writes to repositories. Every one of those capabilities is a selling point. Together, they also constitute a complete attack surface.
When all three conditions are present, an attacker only needs to slip an instruction into content the agent will process. The agent does the rest. Cisco's 2025 AI security research found that 46% of organizations have already experienced internal data leaks through GenAI tools, and 83% lack even basic controls to prevent exposure. Per Deep Inspect's analysis, the average shadow AI breach costs $670,000 more than a standard incident, takes 247 days to detect, and disproportionately exposes customer PII and intellectual property.
Two hundred and forty-seven days to detect a breach is not a detection timeline. It is an exfiltration calendar. Whatever was worth taking is gone roughly 246 days before anyone notices.
Browser extensions as a persistent, privileged attack surface inside agent environments
Extensions run inside the same browser session as the agent. They can observe everything the agent does, intercept data it processes, and hijack active sessions, acting as a parallel privileged layer that is largely invisible to whatever controls organizations believe they have deployed.
According to LayerX's 2026 State of AI Usage Report, AI-powered extensions are present in roughly 15% of employees at small and mid-sized organizations. Nearly 75% of those AI extensions carry high or critical permission levels, and 16.31% already have known CVEs, a higher risk concentration than the broader extension ecosystem. Keep Aware's 2025 telemetry found that 13% of unique installed extensions were classified as High or Critical risk.
The attack pattern is straightforward: malicious code hidden inside a seemingly legitimate productivity extension creates a backdoor that compromises any agent operating in the same environment. The agent itself is entirely secure. The extension watching it is not. Extensions often install without IT visibility, persist across sessions, and require no new authentication event. They are a shadow layer beneath the agent layer, and they are already there, already installed, already running.
Credential exposure at machine speed: how agents amplify the consequences of authentication weaknesses
Browser agents routinely operate inside authenticated sessions that include password managers, SSO flows, and stored tokens. Credential access is incidental to normal operation, not a special escalation. CVE-2025-64496 in Open WebUI illustrates the downstream consequence: malicious external model servers can execute arbitrary JavaScript through SSE execute events, leading to authentication token theft, full account takeover, and, when chained with the Functions API, remote code execution on the backend server.
GitGuardian's State of Secrets Sprawl Report for 2025 found 29 million leaked secrets on GitHub that year and noted that AI-assisted coding doubled credential leak rates compared to manual development. Once credentials are extracted, the attack does not require one person using one stolen password against one system. It enables hundreds of automated agents simultaneously executing credential stuffing at a scale no human-paced attack approaches.
The assumption underlying most authentication controls is that one login attempt represents one person. That assumption breaks entirely at machine scale. The math does not work out for the defender. Eighty-eight percent of organizations reported confirmed or suspected AI agent security incidents in the past year, according to a 2026 enterprise security survey. Most security leaders acknowledge the threat model has shifted. Whether their organizations have updated their controls accordingly is a separate question, and the honest answer is usually no.
MCP and the supply chain layer that sits beneath the browser agent
The Model Context Protocol is the emerging standard by which agents connect to external tools: databases, APIs, internal services. It is increasingly embedded in browser agent workflows and introduces a supply chain attack surface beneath the agent layer itself, one that most security teams have not yet started auditing.
Tool poisoning is the primary vector. An attacker silently modifies an MCP tool's description so the agent misinterprets what the tool does. The agent calls what it believes is a search function; that function actually exfiltrates data. Microsoft Incident Response published a detailed walkthrough of this pattern on June 30, 2026, tracing four phases: silently modified tool description, dynamic re-trust without re-approval, agent execution, and exfiltration through an approved call. The agent trusts the tool description the way it trusts any text it processes. There is no human verification step between the modified description and execution, because there is no human in that part of the loop at all.
Trend Micro's 2026 analysis found 492 MCP servers operating with no client authentication or traffic encryption. BlueRock Security's analysis of more than 7,000 MCP servers found over a third vulnerable to server-side request forgery. Supply chain compromise at the MCP layer can affect every agent that connects to the poisoned tool simultaneously. That is not a single-incident problem; it is a fleet-wide one, and the fleet is large.
Why the controls built for human users don't contain agents — and what containment actually requires
Human-centric access controls rest on a few core assumptions: one action at a time, human judgment before acting, a behavioral pace that makes anomalies visible, and a person who can be interrupted or held accountable. Agents violate every one of them. They act at machine speed, exercise all inherited permissions simultaneously, process untrusted content as instructions, and generate no behavioral signal that legacy monitoring recognizes as anomalous, because every individual action is technically within policy.
Logging after the fact is insufficient. Same-origin bypasses, memory poisoning, and MCP tool-poisoning all operate silently within approved workflows. Nothing fires an alert. Nothing looks wrong in the logs. And by the time 247 days have passed, whatever was worth stealing is long gone.
Gartner's December 2025 recommendation was to block AI browsers entirely. Enterprises continued adopting them anyway, because the business value was immediate and the security risk was, at least initially, deniable. The practical answer cannot be "don't use them." The decision to use them has already been made, is already in production, and is already generating returns that leadership is not inclined to forfeit.
Containment requires a different kind of intervention, not just more of the existing kind applied harder. Visibility is the prerequisite: which agents are running, what sessions they hold, what tools they are calling. A control applied to something you cannot see is not a control; it is a wish dressed up in policy language. Runtime monitoring must cover what agents do during a session, rather than only what the session was authorized to access at the start. Prompt injection filtering at ingestion, rather than after execution, is the only point in the pipeline where injection can be interrupted before consequences occur. Least-privilege scoping for agent sessions, separate from the human user's full credential set, would meaningfully reduce blast radius even when injection succeeds. MCP tool verification and extension auditing close the supply chain and shadow-layer gaps that exist beneath the agent itself.
The security posture most organizations have inherited was designed for a slower, more interruptible actor. The architecture of trust has not caught up to the architecture of the technology. That gap has a price tag and a clock, and both are already running, whether or not anyone has started the audit.
