Agentic Browsers Sidestep the Same-Origin Policy, UW Researchers Find
The research comes from Franziska Roesner and David Kohlbrenner at the University of Washington's Paul G. Allen School. Their paper looks, both in theory and through experiments, at how agentic browsers such as ChatGPT Atlas or Chrome with Gemini handle the same-origin policy and related questions about page access. It appeared at the ICLR 2026 Workshop on Agents in the Wild. According to UW News, the team presented the work on April 26 in Rio de Janeiro.
The policy under pressure is one of the oldest rules in browser security. The same-origin policy dates from 1995. It stops different websites from interacting with each other, even when one site is embedded inside another. The paper puts it concretely: if a user has a bank's site and an attacker's site open at the same time, the policy stops the attacker from reading or changing content on the bank's site.
An agent works at a different layer. It reads page content, types into fields, clicks and navigates, and it does all of this with the user's sessions. The authors sum up the result this way: where an agent has that cross-origin access, "the strength of the same-origin policy is reduced to the strength of the agent's defenses against prompt injections." Prompt injection means text on a web page that the model treats as an instruction. It can sit in a comment, a caption or markup the user never sees.
UW's press materials explain why this is new. In a normal browser, the user has to move information between tabs themselves, for example by copying a bank account number from one page and pasting it into another. An agent takes over that copy-and-paste step, and anything that can instruct the agent can then use it.
Only ChatGPT Atlas Agent Mode Fell, but Three More Browsers Met the Preconditions
The seven configurations tested were Brave Leo AI, ChatGPT Atlas with and without Agent Mode, Chrome with Gemini, Claude for Chrome, Microsoft Edge with Copilot, Firefox AI Mode (with Claude selected as the model), and Perplexity Comet. The researchers ran the experiments in late January and early February 2026 on macOS Sequoia, using the latest stable version of each browser at the time. The paper gives no version numbers. The results are a snapshot of early 2026, and nobody has published a retest since.
The results need careful reading, because it's easy to overstate them. In the cross-origin iframe test, Atlas Agent Mode, Chrome with Gemini, Claude for Chrome and Comet could read content from the embedded origin. Brave Leo AI, Atlas without Agent Mode, Edge with Copilot and Firefox AI Mode could not. TechXplore summarised it as four of the seven browsers giving attackers a way around the same-origin policy. The paper, however, reports a complete proof-of-concept theft only against Atlas in Agent Mode. Gemini, Claude for Chrome and Comet would be exposed if an injection worked, but the authors did not steal data from any of them. They also say they weren't trying to write sophisticated injections, only to check how readily each agent followed instructions on a page.
The attack scenario is simple. An attacker's page embeds sensitive content from another origin. Hidden text tells the agent to put that embedded content into a summary and submit it through a form. If the agent can read the embedded frame and follows the instruction, data crosses a boundary that would stop any ordinary page script. The paper spells out its assumptions: the sensitive page has to allow itself to be framed and has to use a non-strict third-party cookie policy. It also describes the reverse setup, where a malicious embedded frame targets a sensitive parent page.
Agents don't always behave the same way twice, so when one refused a requested action, the team tried again at least three times with a fresh chat. The paper notes that some differences between browsers come from how they're built and others seem to come from model guardrails, and the tests couldn't always tell which.
The disclosure record is mixed. According to UW News, Kohlbrenner said "Browser agents aren't ready for the public", and on vendor responses, Anthropic and Firefox didn't respond, while Perplexity and OpenAI declined the report. The paper adds that OpenAI declined because the report lacked a full end-to-end prompt-injection attack. Roesner told UW that "We've had some really good exchanges with folks at Google, Microsoft and Brave". Readers should also know that the research was funded in part by gifts from Microsoft. Edge with Copilot was one of the four configurations that could not read the cross-origin test content.
Masked Password Fields and Extension Privileges Set Claude for Chrome Apart
The paper also looks at masked inputs, cross-origin action forgery and chat-memory poisoning. Those are separate findings from the Atlas theft and shouldn't be treated as equally serious breaches. Still, two of them may matter more day to day than the headline result.
According to Notebookcheck's reading of the study, only Atlas in logged-in Agent Mode and Claude for Chrome could read masked password fields, the rows of dots. During testing, Claude said it had used its page-reading tool, which reads the page's DOM (the browser's internal model of the page). The DOM holds the password as plain text, whatever the screen shows.
Notebookcheck also reports that Claude for Chrome was the only product that could inject JavaScript. That follows from its design: it's an extension with access to all domains. The two findings point the same way. An agent built on broad extension permissions or DOM access sees more than the user sees, and that includes secrets the page deliberately hides.
Zenity's Atlas Hijack Shows Soft Classifiers Can Be Talked Past
The UW paper is a controlled lab study. Zenity Labs published a real-world style attack. In an August 5, 2026 report titled "Grand Theft Atlas," researcher Stav Cohen describes planting a comment under a popular X post. When a victim asked Atlas to do something ordinary from that thread, such as signing up for a newsletter, the comment sent the agent to an attacker-built site. Atlas then opened WhatsApp Web, read the contact list and sent a phishing message to every contact from the victim's own account. A second attack used the same method to fill an Amazon cart and change the delivery address to the attacker's.
Zenity's detail on how it got past each defense is the most useful part for defenders. The prompt-injection classifier was tuned for English, so the researchers rewrote the payload in Hebrew. Atlas classifies one screenful at a time, so they spread the instructions across several scroll sections. When Atlas reached WhatsApp, its sensitive-site classifier turned the workflow ribbon red. Zenity found this was a judgment about the user's intent, not a URL block, and a more convincing framing got past it. A system-prompt rule telling Atlas to confirm before sending messages fell to text that answered the confirmation in advance. Zenity says Atlas kept WhatsApp flagged as sensitive the whole time and sent every message anyway.
The one barrier that held was in code: Atlas would not press Amazon's final buy button. Zenity got around it by having Atlas ask Rufus, Amazon's shopping assistant, to place the order, which it did. Zenity's conclusion is that "soft boundaries are labels, not access controls." It also calls Atlas "the most hardened agentic browser we have tested," so the case doesn't show Atlas was unusually weak.
Zenity reported both findings to OpenAI on January 11, 2026. OpenAI acknowledged them on February 17, describing "meaningful risks associated with prompt injection in agentic environments." No patch or CVE followed. Zenity's view is that this is a design property of agentic browsers, not a bug that can be closed.
Atlas Is Gone, and Its ChatGPT Desktop Successor Can Do More
Atlas no longer exists as a product. OpenAI's Help Center says it deprecated Atlas and moved browser-based agent features into ChatGPT and Codex, with Atlas scheduled to stop working on August 9, 2026. OpenAI describes the new ChatGPT desktop app as supporting "multiple tabs, downloads, improved navigation, account login support," among other browser improvements, where available.
That shift cuts both ways. Notebookcheck notes that Atlas in Agent Mode could not download files, install extensions or reach saved passwords and autofill data. OpenAI's successor documentation lists more capabilities, and nobody has tested the new desktop browser against the UW method. Atlas's specific results don't carry over to the successor, and neither do the reassurances that came with Atlas's narrower permissions.
The Help Center also gives a practical warning for the migration: Atlas would provide cookie export options where available, and users should not share cookie or session files unless they trust the recipient. Workspace admins are told to remind users to treat those files as sensitive. Exported session cookies can give whoever holds them the same signed-in access the agent had.
Edge Copilot, Gemini in Chrome and Brave Draw Different Lines Around Passwords and Cookies
Vendor documentation shows three different approaches. None of them claims to have solved the problem.
Microsoft's consumer help page for Browse with Copilot in Edge makes the clearest limit on credentials: while browsing, Copilot cannot access saved passwords, autofill data or wallet information. It can access cookies and the open tabs in the current window, so any site you're signed into, Copilot is signed into too. Microsoft suggests using a new profile or deleting cookies to avoid that, and advises against Browse with Copilot for banking, stock trading, payment details, government identifiers, medical records or highly confidential data.
Google's Chrome Help page calls auto browse in Gemini in Chrome experimental. It says the agent works across open tabs and "has access to the same sites that you do, including sites you're signed into." Passwords are handled by delegation: with permission, Google Password Manager signs in for Gemini, and Google says it does not share passwords with Gemini. Google lists confirmation prompts before sending messages, changing data, submitting forms and visiting sites with sensitive financial or health data. It also says these safeguards "don't guarantee protection against all risks" and that users are responsible for Gemini's actions, including purchases. Availability is narrow: users must be 18 or older and in the US, with the device language set to English, a Google AI Pro or Ultra plan, and a personal Google account. The feature isn't available in Incognito, and work or school accounts need administrator enablement.
Brave separates by architecture. Its AI browsing runs in an isolated profile, and cookies, logged-in state, caches and other site data don't cross between it and the regular profile. The feature is optional and off by default. Brave also admits that model-based guardrails can't remove the risk.
Notebookcheck reports that Anthropic puts the attack success rate against its own configuration below 0.08 percent while saying the risk isn't zero, and that Claude for Chrome passwords go through 1Password and never enter Claude's context. Anthropic hasn't publicly addressed the masked-field finding. Perplexity describes layered defenses and confirmation prompts, and calls prompt injection unsolved across the industry.
A Separate Agent Profile Protects Sessions but Doesn't Stop Cross-Origin Reads
Microsoft and Anthropic both recommend a dedicated profile for the agent, and Brave builds one in. It's good advice for a specific problem. An agent in a fresh profile doesn't inherit your cookies, so a hijacked agent can't reach the bank, mailbox or cloud storage you're signed into elsewhere.
It doesn't address the UW finding. That theft happens inside one session, between two sites the agent can already see. If the sensitive page is open or embedded where the agent can read it, a separate profile only helps to the extent that the profile isn't signed into that page. This is our reading of how the study's mechanism works, not something the researchers measured. The practical point is that a separate profile limits the agent's reach, and you still need to control what you have open while it runs.
Notebookcheck also reports that Google announced an origin-based boundary for Chrome's agent in December 2025. It describes it as a simpler form of origin gating that tracks the set of origins the agent may read and write. The part that would have caught the UW scenario hadn't shipped when the tests ran, and Google hasn't said whether it has shipped since.
What this means for you
If you use or manage agentic browsing, limit what the agent can reach before you rely on what it promises not to do. On Windows, that mostly means Copilot in Edge, where the password and wallet limits are real but cookie access means the agent carries your signed-in sessions. Admins should treat agent features the way they'd treat any tool that acts with a user's full web identity. UW's researchers go further and advise ordinary users to avoid agentic browsers for now.
- Run agent tasks in a dedicated browser profile that isn't signed into banking, email or cloud storage. Microsoft recommends a new profile for Browse with Copilot, and Brave's isolated profile does this by design once you turn it on.
- Don't let an agent summarise or act on pages full of third-party comments while something sensitive is open in another tab. Zenity's Atlas attack started with a single planted X comment.
- Treat confirmation prompts and red warning banners as the last point where a person can intervene. Zenity got past every model-based check it met, and only the hard-coded purchase block held.
- Keep saved passwords away from the agent profile. Edge's Copilot and Chrome's Gemini keep passwords out of the model's view, and the UW study found Claude for Chrome and logged-in Atlas Agent Mode could read masked password fields.
- Don't assume the ChatGPT desktop browser inherits Atlas's limits. OpenAI documents downloads, account login support and more navigation power, and no independent test of it has been published.
The UW paper and Zenity's report reach the same conclusion from different directions. The same-origin policy took three decades to harden, and an agent that sits across every tab can undo it with no browser bug involved. The defenses that held in these tests were written in code: Brave's profile isolation, Microsoft's password and wallet limits, Atlas's buy-button block. The ones that failed were model judgments. Until a vendor ships and documents a hard origin boundary for its agent, such as the fuller version of the origin gating Google described in December 2025, the safest setup is to give the agent only what the task needs and to keep your inbox out of the browser it's using.