AI Browsers Put a 30-Year Web Security Rule Under Pressure
For nearly three decades, your browser has relied on one foundational security rule to keep websites separated. If you open your email in one tab and an unknown website in another, that second site should not be able to read your inbox. This protection is known as the same-origin policy, and it is one of the core reasons the modern web can function safely.
AI-powered browsers and browser agents are now testing that assumption in a new way.
The same-origin policy still exists. Scripts from one website still cannot freely access content from another domain. But an AI agent works above that layer. It can look across open tabs, read pages, click buttons, fill forms, navigate websites, and act inside accounts where you are already signed in. In other words, the browser may still separate websites, but the AI assistant may be able to see and interact with them all.
That changes the security question. Instead of asking only whether the browser blocks one site from reading another, users now have to ask whether the AI model can reliably ignore malicious instructions hidden inside web pages.
This is where prompt injection becomes dangerous.
Prompt injection happens when text on a website is interpreted by an AI model as an instruction. It may be visible text, a comment, a caption, or even content placed in page markup. A human may treat it as ordinary page content, but an AI agent may treat it as a command. If that agent has access to your tabs, your accounts, and your session cookies, the result can be far more serious than a misleading chatbot answer.
Researchers warned that, in agentic browsers, the strength of the same-origin policy can effectively depend on the agent’s ability to resist prompt injection. That is a major shift. A hard browser security boundary becomes partly dependent on model behavior.
Two separate research teams reached similar conclusions.
A University of Washington team examined seven AI browser environments in early 2026: Brave Leo AI, ChatGPT Atlas with and without agent mode, Chrome with Gemini, Claude for Chrome, Edge with Copilot, Firefox AI Mode, and Perplexity Comet. Another group from Duke, Stanford, and Berkeley independently arrived at the same broad concern.
The clearest successful cross-origin attack was documented against ChatGPT Atlas in agent mode. In that case, researchers were able to pull data across origin boundaries. For Chrome with Gemini, Claude for Chrome, and Perplexity Comet, the conditions needed for the same type of attack were present, but the researchers did not successfully break them in that test. The authors also noted that they were not trying to build highly advanced attacks, but rather testing whether these systems responded to basic page-based instructions.
Other findings may be even more relevant for everyday users.
Masked password fields, the rows of dots typically shown when a password is entered, were readable in some cases. According to the research, Atlas in logged-in agent mode and Claude for Chrome were able to read those fields. In Claude’s case, the explanation was that the system used a page-reading tool that accessed the page’s DOM, where the password existed as plain text.
The researchers also found that JavaScript injection was possible only in Claude for Chrome among the tested systems, largely because it operated as a browser extension with broad access across domains.
The tests were conducted on macOS in late January and early February 2026 using the stable browser versions available at the time. The research did not list exact version numbers, and there has not been a widely cited independent retest since then. That means the findings are important, but they should also be understood as a snapshot of a rapidly changing field.
A real-world demonstration later showed how serious this can become.
In August 2026, Zenity Labs demonstrated that a planted comment beneath a popular X post could influence ChatGPT Atlas into sending phishing messages through the victim’s own WhatsApp account. The agent opened WhatsApp Web, read contacts, and sent messages from the user’s own number.
The most concerning detail was that Atlas appeared to recognize WhatsApp as sensitive. Its workflow indicator stayed red, yet the agent still completed the action. Zenity argued that this showed the difference between soft warnings and hard security boundaries. A warning label is not the same thing as an access control.
The attack was not effortless. The payload reportedly had to be rewritten in Hebrew and split across multiple scrolls because the filter was stronger in English. Zenity also described Atlas as one of the more hardened agentic browsers it had tested. So the takeaway is not simply that one browser was unusually weak. The broader issue is that prompt injection remains a structural challenge for AI agents that can browse, click, read, and act on behalf of users.
Zenity reported the issue to OpenAI months before publication. OpenAI acknowledged risks connected to prompt injection in agentic environments, but the researchers framed the issue less as a traditional bug and more as a design problem inherent to agentic browsing.
ChatGPT Atlas itself is no longer available. OpenAI shut it down on August 9, 2026, and moved related browsing capabilities into its desktop app. That successor environment is allowed to do more than Atlas could. OpenAI’s documentation describes features such as richer sign-in, autofill, password management, extensions, downloads, and navigation through its own browser state. Atlas in agent mode was more limited; it could not download files, install extensions, or access saved passwords and autofill data. Because the newer environment has different capabilities, older security assumptions may no longer apply in the same way.
Major browser and AI companies now describe different approaches to reducing the risk.
Google says Gemini in Chrome asks for permission before acting. According to Google’s documentation, Google Password Manager can sign in to websites for the agent without sharing the actual password with Gemini. The password manager types the password, while the AI agent does not see it. However, Google also warns that safeguards cannot eliminate every risk, and users remain responsible for Gemini’s actions during a task. The feature is limited to eligible users in the United States, in English, outside Incognito mode, and requires an AI Pro or Ultra plan.
Anthropic says attacks against its own configuration succeed at a very low rate, below 0.08 percent, while still acknowledging that the risk is not zero. Password handling is routed through 1Password, and Anthropic says passwords do not enter Claude’s context. However, that does not directly answer the research finding involving masked fields, leaving an important open question.
Microsoft provides one of the clearest stated boundaries. While Copilot browses and interacts with webpages in Edge, it cannot access autofill data, saved passwords, or wallet information. But Copilot can access cookies. That means if you are already signed into a website, Copilot may be operating inside that logged-in session.
Perplexity describes multiple layers of protection and confirmation prompts for sensitive actions such as email, calendar activity, and purchases. It also calls prompt injection an unsolved industry-wide problem. Its public explanations are less clear on saved password access.
Brave takes a more architectural approach by placing agentic browsing inside an isolated browsing profile. That means cookies, login state, caches, and site data do not cross into the agent profile. This separation may offer stronger protection, though the feature is controlled by a setting that is off by default.
The big lesson is simple: AI browsers are not just regular browsers with a smarter search box. An agent that can read, decide, click, and act inside your logged-in accounts creates a new security model.
The old web security rule was clear: one website should not read another. With AI agents, that rule may still apply to scripts, but the agent sitting above the page can become the bridge between them. If the agent mistakes malicious page text for a valid instruction, private data and trusted accounts can become exposed in ways the traditional browser model was not designed to handle.
For users, the safest approach is to treat AI browser agents like powerful assistants with real account access, not like passive chatbots. Avoid running agent mode while sensitive tabs are open. Be cautious when using AI agents with email, messaging apps, banking, shopping, work dashboards, or password-protected services. Prefer tools that use isolated profiles, strong confirmation prompts, and hard technical boundaries instead of simple warnings.
AI browsing may become one of the most important shifts in how people use the web. But until prompt injection is solved, convenience comes with a serious tradeoff: the browser may still protect sites from each other, while the AI agent must be trusted to do the same.Separate Browser Profiles Can Reduce AI Browser Risks, But They Don’t Fix Everything
AI-powered browser agents are becoming more common, but security researchers warn that users should be careful before letting these tools operate inside a browser where important accounts are already signed in.
Companies are starting to acknowledge the risks. Anthropic and Microsoft advise users to run browser agents in a separate browser profile, with Microsoft recommending a completely fresh profile for extra safety. Brave goes a step further by building profile separation into its AI browsing setup, although users still need to enable it.
Google’s public guidance is less direct. Chrome’s help material mentions separate profiles mainly for shared computers or for keeping work and personal accounts apart. It does not clearly recommend separate profiles as a security measure for AI browser agents.
Using a second browser profile is still a smart move. It can help prevent an AI agent from accessing your personal cookies, saved sessions, and logged-in accounts from your main browser profile. If your primary browser is signed in to email, banking, cloud storage, shopping accounts, and work platforms, keeping an agent away from that environment reduces the chance of accidental exposure.
But this protection has limits.
Researchers found that separate profiles do not fully address a deeper browser security problem. The issue is not only whether an AI agent can access your main browser session. The bigger concern is what happens inside the same session, when the agent is allowed to interact with multiple websites at once.
In that situation, an AI browser agent may be able to move information between sites in ways traditional browser security was designed to prevent. This creates a risk of cross-origin data exposure, where information from one website could influence actions on another website during the same browsing task.
That means a separate profile solves only part of the problem. It can protect your main accounts from being directly taken over, but it does not fully prevent data leakage between websites the agent is already allowed to view.
Some security experts have gone further than the browser makers themselves. Researchers from the University of Washington have warned that agentic browsers are not yet ready for widespread public use. They argue that these tools challenge decades of browser security work built around the same-origin policy, a core rule that keeps websites separated from one another.
How to Lower the Risk When Using AI Browser Agents
The most important thing to remember is simple: an AI browser agent inherits the access of the browser session it runs in.
If you are signed in to email, banking, messaging, file storage, or work dashboards, the agent may be able to reach those accounts while completing a task. Before using an agent, sign out of sensitive services or use a clean browser profile that is not logged in to anything important.
A separate browser profile is one of the easiest safety steps. Ideally, it should have no saved passwords, no payment details, no personal bookmarks, and no active logins. Treat it like a controlled workspace for the AI agent, not like your everyday browser.
If you use Brave, check the AI browsing settings because its profile separation feature is available but may not be enabled by default. Turning it on can help keep the agent away from your normal browsing environment.
It is also wise to remove password manager extensions from any profile used by an AI agent. Even if a browser or AI provider says the agent cannot directly access passwords or autofill data, reducing available sensitive tools lowers the risk.
Avoid asking an AI browser agent to summarize or interact with pages full of third-party content, such as comment sections, public forums, shared documents, or social feeds, while sensitive accounts are open in other tabs. Malicious text hidden in a comment or page could attempt to manipulate the agent into performing unwanted actions.
Confirmation prompts matter. Do not click through them automatically. When an AI agent asks for approval, that prompt may be the final moment where a human can stop a risky action. Read it carefully and ask yourself whether the agent is doing exactly what you intended.
The Remaining Security Gap
At this point, it is still unclear whether all vendors have fully closed the security gap described by researchers. Google announced an origin-based boundary in December 2025, describing it as a simplified version of origin gating that tracks which sites the agent can read from and write to. However, the specific protection that would address the researchers’ scenario had not shipped at the time of testing.
There has been no clear public confirmation on whether that protection has been released since then.
That uncertainty matters. Before leaving your inbox, bank account, cloud files, or messaging apps open while using an AI browser agent, users should ask a basic question: what exactly can this agent access, and what stops it from mixing data between sites?
AI browser agents can be useful, but they also change the security model of everyday browsing. A separate profile is a good start, not a complete solution. The safest approach is to keep agents away from sensitive sessions, limit what they can see, review every action before approving it, and assume that the technology is still developing.
For now, convenience should not come at the cost of handing an AI agent unrestricted access to your digital life.
