Agentic AI browsers — the biggest breakthrough of 2025 — have lurched from promise to peril in less than a year, as independent research led by Brave has exposed systemic vulnerabilities that can turn helpful assistants into covert exfiltration channels, opening new paths for credential theft, privacy erosion, and automated fraud.
Agentic browsers embed an AI assistant directly into the browsing surface and, when permitted, let that assistant act on the user’s behalf: opening tabs, clicking buttons, filling forms, and carrying out multi‑step transactions across sites. Major entrants in 2025 included OpenAI’s ChatGPT Atlas, Microsoft’s Copilot Mode, Perplexity’s Comet, and Brave’s Leo — each pursuing the same productivity gains but with different tradeoffs around privacy, permissions, and telemetry.
Those agentic capabilities are seductive: they compress hours of web research into minutes, automate repetitive workplace tasks, and can be a boon for accessibility. Yet they also create a new kind of attack surface — one where language becomes an operational vector and the model’s trust in page content can be weaponized. Independent technical writeups and vendor advisories now show that prompt injection, hidden instructions embedded in images or comments, and “zero‑click” exploit chains are not just theoretical: they have been demonstrated and, in some cases, exploited in proof-of-concept attacks.
Where claims about specific economic impacts and traffic declines are reported, they should be treated cautiously: metrics about publisher referral loss due to AI summarization vary by methodology and time window. Industry analyses indicate a measurable shift in referral patterns, but precise percentages are sensitive to sample selection and should not be treated as immutable without independent verification.
Source: CNBC TV18 The biggest AI progress in 2025 may be the biggest risk in 2026 - CNBC TV18
Background
Agentic browsers embed an AI assistant directly into the browsing surface and, when permitted, let that assistant act on the user’s behalf: opening tabs, clicking buttons, filling forms, and carrying out multi‑step transactions across sites. Major entrants in 2025 included OpenAI’s ChatGPT Atlas, Microsoft’s Copilot Mode, Perplexity’s Comet, and Brave’s Leo — each pursuing the same productivity gains but with different tradeoffs around privacy, permissions, and telemetry.Those agentic capabilities are seductive: they compress hours of web research into minutes, automate repetitive workplace tasks, and can be a boon for accessibility. Yet they also create a new kind of attack surface — one where language becomes an operational vector and the model’s trust in page content can be weaponized. Independent technical writeups and vendor advisories now show that prompt injection, hidden instructions embedded in images or comments, and “zero‑click” exploit chains are not just theoretical: they have been demonstrated and, in some cases, exploited in proof-of-concept attacks.
What Brave found — a technical summary
The core vulnerability: indirect prompt injection
Brave’s security team analyzed Perplexity’s Comet and produced a public disclosure showing how the assistant ingests raw page content as part of a “summarize this page” request and fails to reliably separate user intent from untrusted page content. Attackers can hide instructions in text, HTML comments, or even nearly‑invisible image text so that the model parses those instructions as operational commands. The result: a summarization request can chain into a multi‑step flow that navigates to authenticated pages, extracts data, and exfiltrates secrets — all without the user’s explicit consent beyond the initial summary request. Brave’s demonstration included a convincing proof‑of‑concept in which hidden instructions in a Reddit comment caused Comet’s agent to (1) retrieve an account email, (2) trigger a one‑time password flow, (3) read the OTP from a logged‑in Gmail tab, and (4) post the credentials back to the attacker-controlled page. The disclosure timeline shows coordinated reporting and patch attempts, but Brave reports that some mitigations were incomplete and that the conceptual gap — how to safely treat page content as untrusted instruction inputs — remains unresolved.Screenshots, images, and invisible text as covert channels
Beyond visible HTML, Brave also described how image‑based channels and near‑invisible text (light contrast, zero‑width characters, or color‑matched text) can survive OCR and extraction pipelines and then be interpreted by assistants. That means a screenshot or an image uploaded to an assistant can carry hidden prompts that the model will follow — a particularly dangerous avenue because screenshots are a common, user‑initiated workflow. Multiple independent outlets replicated the core findings and emphasized that this class of vulnerability affects many agentic browsers, not just a single product.Why this matters: the expanded threat surface
Agentic browsers combine three properties that materially increase risk compared with traditional browsing:- Persistent access to page content, tabs, and session state, including cookies and authenticated sessions.
- The ability to act — to navigate, click, and submit forms using the user’s active credentials.
- Natural‑language interpretation of web content, which is subject to adversarial manipulation via prompt injection, steganography, and covert channels.
Enterprise and identity implications
In enterprise contexts the stakes are higher. Agents acting inside a user’s logged‑in browser profile can access enterprise SSO tokens, internal dashboards, and email. Microsoft’s 2025 threat assessments highlight that attackers are increasingly using automation and AI to scale credential abuse and phishing, and that AI‑driven attacks amplify the speed and reach of those campaigns. Treating agents as privileged automation accounts — with least‑privilege tokens, short lifetimes, and explicit admin governance — is essential.Privacy and data‑profiling risks
Agentic memories and persistent context features promise convenience but also centralize extremely sensitive behavioral signals. When a browser assistant accumulates cross‑session histories, connectors to email and cloud storage, and fine‑grained interaction logs, it builds a profile of personal life events, health data, finances, and preferences that did not exist in this form for most users. That data concentration elevates the risk of abuse — whether via breaches, lawful requests, or vendor misuse. Brave’s positioning as a privacy‑focused alternative emphasizes this difference, arguing that agentic browsers must be designed with strong default limits and transparent retention policies.Technical anatomy of the attack vectors
1. Prompt injection via page content
Attackers embed natural‑language instructions inside page text, hidden HTML comments, or spoiler tags. Because many assistants feed a page’s text straight into the model prompt for summarization or analysis, the model cannot distinguish between “summarize this” and the malicious instruction. This is the classic prompt injection attack and is the primary mechanism Brave outlined against Comet.2. Invisible text and zero‑width channels
Zero‑width characters, Unicode smuggling, and color‑matched text survive superficial sanitization and are included in the raw input the assistant receives. Models and OCR systems that do not canonicalize and strip such artifacts are vulnerable to invisible instruction channels. Independent research and vendor red teams have demonstrated several variants.3. Image‑based exfiltration (OCR and screenshot trickery)
Assistants that can analyze screenshots or images introduce an additional covert channel: attackers can place faint or low‑contrast text inside an image that OCR will extract and the model will treat as instructions. Given how often users take screenshots to ask assistants for help, this is a practical and high‑impact vector.4. Config rewriting and auto‑approve abuse
In developer or automation agents, attackers have shown how to manipulate an agent into writing configuration files that expand permissions or remove confirmation prompts. The same pattern applies in browsers that allow agents to modify settings or site permission lists, which can transform a one‑off exploit into persistent, automated exploitation.Cross‑reference: multiple sources confirm the problem
Brave’s detailed blog post presents both the attack technique and a disclosure timeline to Perplexity, and it documents both the exploit mechanics and the limitations of vendor patches. Independent technology publications and security outlets corroborated the core findings and broadened the analysis to other agentic browsers including Atlas and Copilot Mode. Microsoft’s threat reporting and third‑party security audits echo the same warning: attackers are adopting AI‑driven scaling techniques and new exploitation vectors that AI agents can accelerate if left unchecked. Together, these sources establish a consistent, cross‑validated narrative: agentic browsing introduces unique, demonstrable risks that current web security models were not designed to handle.Practical guidance: what vendors must do
Brave’s disclosure and industry analyses converge on a set of engineering and product design principles that must be adopted to mature agentic browsing safely:- Treat page content as untrusted by default. Agents should not accept page content as operational instructions without canonical sanitization and explicit separation between user prompts and content-derived input.
- Implement strict permissioning and scope for actions. Agent actions that would touch authenticated accounts, payments, or system resources must require step‑up authentication, explicit user approval, and a visible audit trail.
- Canonicalize and sanitize inputs early in the pipeline. Zero‑width characters, hidden HTML comments, and faint image text should be normalized or stripped before ingestion.
- Design robust pause points and “why I did that” logs. Every agent action should be accompanied by an auditable, replayable rationale that users and admins can inspect.
- Adopt least‑privilege agent identities and short‑lived tokens. Treat agents as distinct identities that should not inherit broad, long‑lived privileges by default.
Practical guidance: what enterprises and IT teams must do now
For organizations that manage Windows fleets and enterprise browsing environments, the recommendations are concrete and immediate:- Inventory and classify where agentic browsers or agent‑enabled extensions are in use. Many enterprise apps embed Chromium forks that can host an agentic assistant; discovery tools and CASB telemetry are essential.
- Restrict agent actions by default. Use Group Policy, MDM, or enterprise browser controls to disable agent automations on managed profiles and limit connectors to approved services.
- Treat agent prompts and actions as auditable events. Capture prompts, timestamps, and assistant responses for forensic review and compliance. Require human confirmation for any operation that touches credentials, payments, or regulated data.
- Harden DLP for ephemeral flows. Standard DLP focused on attachments misses clipboard and paste events; extend DLP to cover browser clipboard events and agent uploads.
- Red‑team with prompt‑injection scenarios. Add adversarial content tests into web and application security programs to evaluate how agents react to crafted inputs.
Policy and regulation — the missing global benchmark
Agentic AI browsers sit at the intersection of web platform law and emerging AI regulation. Traditional data protection frameworks like the EU’s GDPR govern data controllers and processors, but agentic browsers blur lines: they are both a browser (software running on a user’s device) and an AI intermediary that may process and retain personal context. Meanwhile, AI‑specific frameworks such as the EU AI Act are still being operationalized and do not yet provide a single global standard for agentic behaviors, audit trails, or memory deletion guarantees. Multiple independent analyses warn that absent coordinated standards, vendors will effectively write their own rulebooks and variances in defaults and retention policies will create regulatory and compliance mismatches for multinational organizations.Where claims about specific economic impacts and traffic declines are reported, they should be treated cautiously: metrics about publisher referral loss due to AI summarization vary by methodology and time window. Industry analyses indicate a measurable shift in referral patterns, but precise percentages are sensitive to sample selection and should not be treated as immutable without independent verification.
Strengths, limitations, and the tradeoffs ahead
Strengths worth preserving
- Productivity gains: Agents genuinely reduce friction for research, synthesis, and repetitive tasks. For many knowledge‑worker workflows, the time savings are real and compelling.
- Accessibility improvements: Natural language and voice interactions make web tasks more accessible to users with motor or vision limitations.
Limitations and existential risks
- Security brittleness: Current mitigations reduce but do not eliminate prompt injection risk. Attackers need only one effective technique to cause high‑impact harm.
- Privacy concentration: Consolidating browsing history, memories, and cross‑service connectors into a single vendor creates a tempting target and regulatory pressure.
- Economic externalities: Publishers may lose referral revenue if assistants answer questions without sending users to source pages, potentially fracturing the web’s ad‑supported model. This is an open policy and business question that will influence product design and industry agreements.
A short roadmap for safer agentic browsers
- Vendors should adopt a “deny‑by‑default” posture for agentic actions, implement canonical input sanitization, and ship visible audit trails.
- Enterprises should treat agented browsing features as privileged capabilities and apply the same lifecycle controls used for automation platforms: inventory, least privilege, short token lifetimes, and continuous red‑teaming.
- Regulators should expedite guidance on auditability, retention limits for memories, provenance metadata for AI‑generated content, and clear consumer‑facing disclosures about what data is used and how to delete it.
Conclusion
Agentic AI browsers delivered the most tangible productivity frontier of 2025: assistants that read the web and can act for users. But the very properties that make them powerful also make them dangerous when adversaries weaponize language and covert channels. Brave’s responsible disclosure into Perplexity’s Comet — and the wider corroboration from independent outlets and vendor advisories — should be read as an urgent engineering and governance call to action: the race for feature velocity must be matched by a race for robust, auditable security and privacy guardrails. What follows in 2026 will be decisive. If vendors, enterprises, and regulators treat agentic browsing as an architectural shift that requires new security primitives and stronger consent models, the technology can become a productive, safe companion. If not, those same agents will turn millions of routine interactions into scalable exploitation channels — a transformation where the biggest progress becomes the biggest systemic risk.Source: CNBC TV18 The biggest AI progress in 2025 may be the biggest risk in 2026 - CNBC TV18
