AI browsers raise security concerns ^{CEFR B2}

The University of Washington team examined seven popular agentic browsers and concluded that four of them provide ways for attackers to bypass the same-origin policy, a core browser rule introduced in 1995 that prevents different websites from accessing each other's data. Professor Franziska Roesner said the policy is fundamental to how modern browsers protect information.

In a proof-of-concept cyberattack on ChatGPT Atlas, researchers showed how a website that embeds another site can steal information, with a concrete example of an ad on an email page taking sensitive data from the user's messages. The team also identified conditions for similar attacks in three other browsers, including Chrome with Gemini, Claude for Chrome, and Perplexity Comet. Generally, browsers that gave agents fewer permissions were safer.

The study explains two main technical risks in detail. Prompt injection occurs when a malicious page hides instructions that cause an agent to reveal or move data; the paper gives an example of a hidden instruction that asks an agent to summarize embedded content and submit that summary to a form. Memory poisoning happens when agents store what they learn and later mix information from different origins while revising and compressing memory.

The researchers shared their findings with the companies behind the browsers. Anthropic and Firefox did not respond, while Perplexity and OpenAI declined the report; the team had exchanges with Google, Microsoft and Brave. The study was presented at the Agents in the Wild Workshop in Rio de Janeiro and was funded in part by gifts from Microsoft.