Image: TechcityAuthority

Imagine asking your browser's AI assistant to summarize a forum thread. Instead, the agent reads a line you never saw, hidden in a comment, that tells it to open your email, copy a login code and post it in a public reply. The agent does it, because it cannot reliably tell the page's text apart from your request.

That is close to a real demonstration. In August 2025, security researchers at Brave showed this kind of attack against Perplexity's Comet browser, using a Reddit comment hidden behind a spoiler tag. This guide sets out what the published research says, what vendors report they have done, and what everyday users can do. Every figure is attributed to its source.

What prompt injection is

Prompt injection means getting an AI model to treat text as an order when it should treat it as material to read. The University of Washington researchers Franziska Roesner and David Kohlbrenner describe it as an attack "enabled when an agent misinterprets data as additional instructions."

There are two main forms. In a direct attack, the person typing tries to talk the chatbot out of its rules. In an indirect attack, the instructions sit inside content the model reads for a legitimate reason, such as a web page, an email, a PDF or a screenshot. The user never types anything wrong. Brave says such instructions can hide in white text on a white background, in HTML comments, or in user posts on sites like Reddit.

Why can't the model just ignore them? A language model reads everything as one stream of words. Your request and the site's text arrive the same way. Brave said Comet fed part of a page to its model without distinguishing between the user's instructions and untrusted content. OpenAI, for its part, says prompt injection is unlikely to ever be fully "solved", and compares it to online scams that keep evolving.

Image: TechcityAuthority

Why a browser raises the stakes

A chatbot that can only reply with text has limited ways to hurt you. A browser agent can click, type and submit forms, often while you are signed in to your email, bank or work tools. OpenAI describes Atlas agent mode as one where the agent views webpages and takes actions, clicks, and keystrokes inside your browser, just as you would.

Then there is the same-origin policy. It is a browser rule that stops one site from reading another. In the University of Washington example, if you open a malicious site next to your bank in another tab, the rule keeps the attacker from reading the bank page or its cookies. Brave argues that an agent following hidden instructions makes this rule "effectively useless", because the agent acts with your logins on every site.

The Washington team tested that idea in a study published on its site and last updated on April 15, 2026. It tested seven agentic browsers in early 2026. They included ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, Edge with Copilot, Brave and Comet. The headline finding is that, in several of them, the same-origin policy is "reduced to the strength of an agent's defenses against prompt injections."

The researchers demonstrated a full proof-of-concept data theft on ChatGPT Atlas in Agent Mode. In it, a malicious page embeds a sensitive page in a frame, the user asks the agent to summarize, the agent falls for the injection, and the summary is sent to the attacker through a form. For Chrome with Gemini, Claude for Chrome and Comet, the team says the preconditions for the same attack exist, if a prompt injection succeeds. It did not show a completed attack on those three.

The study lists limits. The scenario relies on the sensitive site allowing itself to be framed and on a non-strict third-party cookie setting. They say OpenAI declined their report because they did not have a full end-to-end prompt injection attack. The work was supported in part by gifts from Microsoft, which the team discloses. Their advice is to proceed with caution because "the security models have not yet been worked out." They single out Claude for Chrome as riskier because, as an extension, it can inject JavaScript into pages. They describe Brave, Edge and Firefox as more limited but stronger on security at this time.

What researchers have found in real products

Brave's first post, from August 20, 2025, covered Comet's summarize button. In its proof of concept, a hidden Reddit comment told the assistant to fetch the user's email address, trigger a login code, read that code in Gmail and reply with both on Reddit. Brave says Perplexity's first fix was found incomplete in a retest. After publication, Brave added that Perplexity still had not fully mitigated this kind of attack. Brave is a rival browser maker, and its posts do not say where Comet stands today.

Brave's second post, from October 21, 2025, described a different route. Brave hid instructions in a screenshot as faint light blue text on a yellow background, barely visible to a person. Brave could not confirm how the text was read, since Comet is not open source. It also said the Fellou browser passed a site's visible text to its model just from a request to visit the page. Brave concluded that indirect prompt injection is a systemic challenge for the whole category of AI browsers.

A third line of research looks at the browser's own plumbing. A KAIST-led team, with researchers from Oregon State University and Seoul National University, published "Site Isolation is Dead" at the 2026 IEEE Symposium on Security and Privacy. Site isolation keeps pages from different sites in separate processes. The team examined two open-source agentic browsers and seven agentic extensions, and says all were vulnerable to its attacks, which run through the channels that connect those processes.

Two details matter. The nine products examined include BrowserOS and Nanobrowser, not the products from OpenAI, Google or Perplexity. And the attacks assume the attacker has already broken into the process showing their page through a separate browser bug, which the researchers did using known flaws in an older Chromium build. From there, they say a forged message can make the agent run attacker prompts or hand over stored chat history and API keys. In one example, they retrieved a victim's submitted paper from a conference review site and sent phishing emails on the victim's behalf.

How the vendors are responding

OpenAI's December 22, 2025 post describes an automated attacker, an AI model trained with reinforcement learning to hunt for injections that work against the Atlas agent. In one OpenAI demo, a planted email made the agent send a resignation letter to the user's CEO when asked to draft an out-of-office reply. OpenAI says findings like this fed a newly adversarially trained model that has been rolled out to all Atlas users, along with stronger safeguards around it. The post gives no attack success rate, so there is no number to compare.

Anthropic has published numbers, all from its own testing. When it previewed Claude for Chrome in August 2025, it reported a 23.6% attack success rate without its safety mitigations across 123 test cases covering 29 attack scenarios. With mitigations in autonomous mode, it said that fell to 11.2%. On a separate challenge set of four browser-specific attack types, it said the rate dropped from 35.7% to 0%. Ars Technica reported that Willison called the remaining 11.2% "catastrophic."

In November 2025, Anthropic said that its newer model, Claude Opus 4.5, together with added safeguards, reached about a 1% attack success rate against an internal adaptive attacker that gets 100 attempts per environment. The company added that a 1% rate "still represents meaningful risk." Anthropic's current safety guidance for Claude in Chrome says its present setup, using Claude Opus 4.8, reduces attack success to less than 0.08% against internal testing that combines known attack techniques. It also says the risk is not zero. These figures come from different tests, models and years, so they should not be read as one trend line. None has been independently verified.

Image: TechcityAuthority

Perplexity's researchers, working with academics at Rutgers and Purdue, took a different tack in a paper on BrowseSafe. They built BrowseSafe-Bench, a set of 14,719 attack and benign page samples, and released it publicly. Their defense has several layers. It treats everything fetched from the web as untrusted, strips AI-written summaries before checking, scans large pages in chunks, flags a whole page if any chunk looks malicious, and swaps flagged content for a placeholder. The team reports an F1 score of up to 0.904 with a response time under one second, ahead of the frontier models it compared. These are the authors' own results on their own benchmark.

Where defenses still fall short

The same paper also shows the weak spots. Across more than 20 models, average detection accuracy was 90.5% on clean pages, but it fell to 81.3% once realistic distractors were added. Distractors are harmless page features meant to look like attacks. The authors call that a drop of roughly 10 points.

Attacks written as ordinary visible content were also harder to catch, at 69% to 75% accuracy compared with 87% to 92% for hidden injections. Multilingual attacks were the hardest category at 76.0%, which the authors say suggests detectors lean on English-language cues. When the team held out injection styles the detector had never seen, its F1 score fell to 0.788 from 0.905.

Two cautions apply. These are scores for detection tools in a benchmark, not rates for shipped products. And the paper says BrowseSafe does not cover attacks hidden in images, which is the route Brave used on Comet.

How to stay safer

Every vendor above says the risk is not zero, so your habits are part of the defense. This is my advice, drawn from what OpenAI, Anthropic, Brave and the Washington researchers recommend.

Limit where the agent can go. Anthropic's guidance is to start with trusted sites. OpenAI recommends using logged-out mode in Atlas whenever the task does not need your accounts.

Keep action confirmations on, and read them. OpenAI says Atlas asks before consequential steps such as completing a purchase or sending an email, and Anthropic describes similar action confirmations for Claude. A confirmation you click through unread is a defense you have switched off.

Keep agents away from banking, health, legal and work accounts. Anthropic strongly advises against using Claude in Chrome for financial accounts, legal documents, medical information and sensitive company data.

Use a separate browser profile for agent work. Anthropic recommends a profile with no access to sensitive accounts. That way, even a hijacked agent has little to reach.

Give narrow, specific instructions. OpenAI warns that broad prompts such as reviewing your emails and taking whatever action is needed give hidden content more room to steer the agent.

Watch for odd behavior and stop the task if you see it. Anthropic's signs include the agent drifting to unrelated topics, visiting unexpected sites or asking for sensitive information.

Keep your browser and agent updated. Fixes only help if you have them. OpenAI says its newer Atlas model went out to all users, and the KAIST attacks used an old Chromium build with known bugs.

The bottom line

AI browser agents can save time, and vendors are working on the problem. Attack rates that companies report from their own testing have fallen. But those figures are self-reported, they come from different tests, and no vendor claims the problem is solved. Independent researchers keep finding new routes, from hidden text to faint text in screenshots to flaws in browser design.

These are useful but young tools whose security models are still being worked out. Until that changes, treat an AI agent in your browser like a capable assistant who can be fooled by a forged note, and keep it away from anything you could not afford to have it mishandle.