Researchers at the University of Washington studied seven popular agentic browsers and found that four provided ways to bypass the same-origin policy, the rule that keeps different websites from accessing each other's data. Franziska Roesner, a UW professor, said that policy is fundamental to how modern browsers protect information.
The team ran a proof-of-concept attack on one browser, showing that an embedded site could steal data — for example, an ad on an email site taking sensitive information. The researchers also found similar conditions in three other browsers. Browsers that gave agents fewer permissions were generally safer.
The paper describes two main technical risks. Prompt injection is when a malicious page hides instructions that trick an agent into revealing or moving data. Memory poisoning happens when agents store and later mix information from different origins while revising and compressing memory. Co-senior author David Kohlbrenner warned that browser agents are not ready for the public. The team shared their findings with browser companies.
Difficult words
- same-origin policy — rule that stops websites sharing data
- agent — software that performs tasks for usersagents
- bypass — avoid a rule or security control
- embedded — placed or included inside something else
- prompt injection — malicious instructions hidden on a web page
- memory poisoning — when stored information from different sites mixes
- permission — rights to do or access somethingpermissions
Tip: hover, focus or tap highlighted words in the article to see quick definitions while you read or listen.
Discussion questions
- Do you think browser companies should give agents fewer permissions? Why or why not?
- How could an ad on a website take sensitive information from a user in this example?
- What steps could browser developers take to make agents safer for the public?
Related articles
Tool that Reorders X Feed Reduces Partisan Rancor
Researchers built a browser extension that scans an X feed for antidemocratic and partisan posts and reorders them without removing content or platform cooperation. Tests during the 2024 election showed small but measurable improvements in attitudes toward the other party.
Molecule stores sunlight and releases heat on demand
Chemists at UC Santa Barbara designed a modified molecule called pyrimidone that captures sunlight, stores it in chemical bonds and releases it as heat when triggered. Tests released enough heat to boil water under normal conditions.