A University of Washington study looked at seven agentic web browsers released by companies in the last year. The researchers tested how these browsers let AI agents open tabs, research options and perform tasks for users.
They found that four browsers provided ways for attackers to bypass the same-origin policy, a rule that keeps different websites from accessing each other's data. In a proof-of-concept test, a website embedded another site and stole information, for example an ad taking sensitive data from a user's email.
The study explains two main risks. One is prompt injection, where hidden instructions trick an agent into moving or revealing data. The other is memory poisoning, where agents mix stored information from different sites. Browsers that gave agents fewer permissions were generally safer, and the researchers told companies about the problems.
Difficult words
- agentic — software that acts and makes choices for users
- same-origin policy — rule that stops different websites sharing data
- embed — to put one thing inside another, for example a siteembedded
- prompt injection — hidden instruction that makes an agent reveal data
- memory poisoning — mixing stored information from different sources
- permission — allowed access or rights to use a featurepermissions
Tip: hover, focus or tap highlighted words in the article to see quick definitions while you read or listen.
Discussion questions
- Would you use a browser that lets AI agents open tabs? Why or why not?
- How could companies make browsers safer from these risks?
Related articles
Tool that Reorders X Feed Reduces Partisan Rancor
Researchers built a browser extension that scans an X feed for antidemocratic and partisan posts and reorders them without removing content or platform cooperation. Tests during the 2024 election showed small but measurable improvements in attitudes toward the other party.
Molecule stores sunlight and releases heat on demand
Chemists at UC Santa Barbara designed a modified molecule called pyrimidone that captures sunlight, stores it in chemical bonds and releases it as heat when triggered. Tests released enough heat to boil water under normal conditions.