Researchers at the University of Washington studied seven popular agentic browsers and found that four provided ways to bypass the same-origin policy, the rule that keeps different websites from accessing each other's data. Franziska Roesner, a UW professor, said that policy is fundamental to how modern browsers protect information.
The team ran a proof-of-concept attack on one browser, showing that an embedded site could steal data — for example, an ad on an email site taking sensitive information. The researchers also found similar conditions in three other browsers. Browsers that gave agents fewer permissions were generally safer.
The paper describes two main technical risks. Prompt injection is when a malicious page hides instructions that trick an agent into revealing or moving data. Memory poisoning happens when agents store and later mix information from different origins while revising and compressing memory. Co-senior author David Kohlbrenner warned that browser agents are not ready for the public. The team shared their findings with browser companies.
Difficult words
- same-origin policy — rule that stops websites sharing data
- agent — software that performs tasks for usersagents
- bypass — avoid a rule or security control
- embedded — placed or included inside something else
- prompt injection — malicious instructions hidden on a web page
- memory poisoning — when stored information from different sites mixes
- permission — rights to do or access somethingpermissions
Tip: hover, focus or tap highlighted words in the article to see quick definitions while you read or listen.
Discussion questions
- Do you think browser companies should give agents fewer permissions? Why or why not?
- How could an ad on a website take sensitive information from a user in this example?
- What steps could browser developers take to make agents safer for the public?
Related articles
Latin American groups build AI to study gender violence
Groups in Latin America create open, local AI tools to study gender inequalities and violence. Projects like AymurAI search court documents, protect sensitive data on local servers and help governments and civil society with evidence.
