This post is also available in:
עברית (Hebrew)
AI-powered web browsers are beginning to move beyond answering questions. Many now include autonomous agents capable of browsing websites, comparing products, booking travel, filling out forms, and interacting with multiple online services on a user’s behalf. While these capabilities promise greater convenience, security researchers are warning that giving AI this level of browser access may introduce entirely new cyber risks.
A recent study found that several popular AI-enabled browsers, such as ChatGPT Atlas, Chrome with Gemini, Claude for Chrome and Perplexity Comet weaken one of the web’s most fundamental security mechanisms: the same-origin policy.
The same-origin policy has protected internet users for decades by preventing one website from accessing information belonging to another. It allows users to browse different sites simultaneously without those sites being able to directly interact with each other’s sensitive data.
Researchers found that some AI browser agents operate differently. According to TechXplore, because the AI is designed to read information across multiple tabs and websites to complete tasks, it may inadvertently bridge security boundaries that conventional browsers keep strictly separated.
To demonstrate the risk, the researchers created a proof-of-concept attack showing how a malicious webpage could trick an AI agent into exposing information originating from another site. Instead of directly hacking the browser, the attack manipulated the AI itself through hidden instructions embedded within webpage content.
This technique, known as prompt injection, works by inserting instructions that the AI may interpret as legitimate commands. For example, an AI agent asked to summarize a webpage could unknowingly follow hidden instructions directing it to include sensitive information from other browser sessions and submit it elsewhere.
Researchers also identified another emerging threat known as memory poisoning. Many AI agents maintain internal memory to improve future interactions. If malicious information enters that memory, it may later influence the agent’s behavior in unrelated browsing sessions after the original source has been forgotten.
From a cybersecurity perspective, these findings are particularly significant because browsers increasingly serve as gateways to email, financial services, enterprise systems, government portals, and cloud applications. AI agents with broad browser permissions may inadvertently gain access to highly sensitive information if appropriate safeguards are not in place.
The study found that browsers offering the most capable autonomous features generally presented greater security exposure, while systems with more limited AI permissions proved less vulnerable.
As AI assistants become more deeply integrated into web browsers, researchers argue that preserving long-established browser security models while enabling advanced automation remains one of the industry’s most important unresolved challenges.
The research was published here.
