Don't Let Your Team Install an AI Browser Yet

I pay for four AI subscriptions. I build AI tooling for clients. My whole workflow runs through agents, and I would defend that setup to anyone.

I still have not installed an agentic browser in the profile where my email, my bank and my clients' admin panels live. Not because I think the technology is bad. Because of what happens if it goes wrong once.

That distinction is the whole point of this post. Agentic browser security is not a debate about whether AI browsers are useful. They are. It is a debate about blast radius, and about timing.

What Brave Actually Found in Comet

On 25 July 2025, Brave's security team reported an indirect prompt injection flaw in Perplexity's Comet browser. Their public writeup went out on 20 August.

The demo is worth understanding in detail, because it explains everything that follows.

A Reddit comment contained instructions hidden behind a spoiler tag. Invisible to a human skimming the thread. The user then clicked Comet's "Summarize the current webpage" button, which is the single most boring thing you can do with an AI browser. Comet fed the page text to its model without separating "what the user asked me to do" from "text that happened to be on the page." It read the hidden instructions as commands.

What it then did: pulled the user's email address from their Perplexity account page, triggered a login flow, went into the user's Gmail, read the one-time password out of the inbox, and posted both the email and the OTP back as a reply to the original Reddit comment.

Brave's line about it stuck with me. Traditional protections like same-origin policy and CORS are "effectively useless" here. Those rules stop a page from reading another page. They do not stop an assistant that has legitimate access to both from being talked into carrying data between them.

Perplexity acknowledged it within two days and shipped a fix on 27 July. Brave tested on 28 July and found the fix incomplete. It looked patched again on 13 August. Brave later reported it still was not fully mitigated. That pattern, patch, bypass, patch, is not incompetence. It is what it looks like when the bug is in the design rather than in a function.

Brave went further on 21 October 2025 with unseeable prompt injections in screenshots: instructions written in faint light-blue text on a yellow background, unreadable to a person, extracted perfectly by the OCR step and handed to the model as input.

The Problem Is the Session, Not the Browser

Here is the thing that makes this structurally different from every browser vulnerability you have read about before.

Nobody stole a credential in the Comet demo. Nobody cracked a password, phished a login, or planted malware. The attacker never touched the victim's machine. The agent was already logged in, as the user, with the user's cookies and the user's permissions, and it simply did what it was told.

Your browser profile is not a browser. It is a keyring. Mine holds Gmail, the Directus admin for every client site I run, Hetzner, Cloudflare, Stripe, my bank, and a password manager extension. An agent operating inside that profile inherits all of it at once. Not read access. Full authenticated user access, including the buttons that delete things and the buttons that move money.

Ordinary web security assumes the attacker is outside the trust boundary trying to get in. Here the attacker is content. Just text on a page you asked your assistant to read. The trust boundary already contains them.

I wrote before about how everyone is selling AI shovels while nobody checks whether their own barn is locked. This is the sharpest version of that: the tool that is supposed to make you more productive is the tool holding every key you own.

PleaseFix Turned It Zero-Click

On 3 March 2026, Zenity Labs disclosed a vulnerability class it named PleaseFix. The Cloud Security Alliance published a research note on it on 28 March, and Zenity published the full scope in August 2026.

Read the disclosures carefully, because the wording matters. PleaseFix is described as a family, not a single bug: six attack subfamilies covering data theft, credential compromise, account takeover, local file exfiltration and remote code execution. Affected products named in the disclosures include Perplexity Comet, ChatGPT Atlas, Copilot Edge, Claude in Chrome and Gemini in Chrome.

The mechanism Zenity calls "intent collision." Malicious instructions sit inside content the agent meets during normal work: an email, a calendar invite, a web page. When the user makes a legitimate request, the injected instructions collide with it and redirect the agent, using the user's own identity and permissions.

Zero clicks. No malicious code on the victim's device. No social engineering of a human at all, because the human is not the one being fooled.

The published example: an ordinary "summarize my email" request that exfiltrated Gmail data, silently shared the victim's entire Google Drive with the attacker, and enabled takeover of the victim's Slack, X and Claude accounts.

The follow-on detail I keep thinking about is the Perplexity one. Perplexity responded by blocking file system access with a hard boundary. Researchers then bypassed that boundary twice, using view-source:file:// URLs and file suffix tricks. Good-faith fix, defeated by two more days of thinking. That is where this category currently is.

Different class, same shape as the supply chain problem with AI coding assistants: a system that cannot verify what it is being handed, acting on it anyway with your authority.

The Vendors Have Not Done Nothing

I want to be fair here, because the "AI browsers are unsafe, full stop" takes are lazy and the vendors have shipped real work.

Anthropic published numbers for Claude in Chrome, which is more than most. On their adversarial test set, the attack success rate was 23.6% without mitigations and 11.2% with mitigations in autonomous mode. On a narrower challenge set of four browser-specific attack types, they got 35.7% down to 0%. They also blocked whole site categories outright, including financial services, added site-level permissions, and required confirmation before high-risk actions like publishing, purchasing or sharing personal data.

OpenAI shipped a logged-out mode so ChatGPT agent can act without your credentials attached, and CISO Dane Stuckey wrote publicly, in October 2025, that prompt injection "remains an unsolved problem" they expect to persist as agents gain autonomy. That is an unusually honest thing for a vendor to publish about their own launch, and it deserves credit.

Now sit with those two facts together. 11.2% is a large improvement on 23.6%. It is also roughly one in nine, on the vendor's own test set, in a system that holds your live sessions. Anthropic is not hiding that. They shipped it as a research preview with a deliberately restricted install, which is the correct posture.

And in June 2026, University of Washington researchers reported that of seven agentic browsers they studied, four created ways to bypass same-origin policy, with a working proof of concept against ChatGPT Atlas that let one site pull information out of another embedded in it. Franziska Roesner's summary was blunt: browser agents are not ready for the public. Per the UW announcement, Google, Microsoft and Brave engaged with the researchers, Anthropic and Firefox did not respond, and Perplexity and OpenAI declined the report. Note also their finding on the tradeoff: the least risky browser they tested, Firefox AI Mode, was also the most limited. That is not a coincidence, and it is why this will not be fixed by one patch.

There is also NeuralTrust's October 2025 finding that Atlas's omnibox could be fed a string shaped like a URL but malformed enough that the agent treated it as trusted user intent, and acted on the embedded command with the user's authenticated session.

The Policy I Actually Run

None of that adds up to "ban AI." It adds up to a boring separation rule that costs almost nothing to follow.

No agentic browsing in any profile that holds email, payroll, banking, or client admin access. That is the one rule that does most of the work. Not "be careful in that profile." Not there at all.

Separate browser profile for experiments, or better, a separate machine. A second Chrome profile with nothing signed in except the AI browser account itself takes four minutes to set up. If you have a spare laptop, use that instead, because a profile boundary is a software boundary and this whole post is about software boundaries being talked around.

Never approve an agent action you would not approve manually. The confirmation dialog is not a formality. If the agent asks to send an email you did not ask it to send, or open a page you did not name, that is the entire warning you are going to get. Read it as if a stranger asked you to do it.

Nothing agentic touches a client account. Ever, for me. Their Directus, their Stripe, their DNS. My convenience is not a good enough reason to put someone else's business inside an experimental trust boundary, and it is not my risk to take on their behalf.

Turn off the memory and cross-session features while you are experimenting. Several of the named exploits in this class persist by writing into the agent's memory, so a single bad page becomes a standing instruction.

Write it down in one paragraph. A two-person company does not need a security policy document. It needs one paragraph in whatever wiki or notes file you already have, so the rule exists before someone asks rather than after.

If you want the wider version of this for your actual infrastructure, my website security hardening checklist covers the boring layer underneath all of this.

What to Tell the Employee Who Wants to Try One

Someone on your team is going to ask. They should. Curiosity about this stuff is a good sign, and if you answer with a flat no you will just get shadow adoption.

Say yes, with a boundary. Something like: yes, install it, use the sandbox profile, do not sign into anything company-owned inside it, and tell me what you learn. Then actually read what they send you.

The reason this works better than a ban is that the useful part of these browsers is real. Research, comparison, reading through documentation, filling out tedious forms on sites where nothing is at stake. All of that is genuinely faster. None of it needs your Gmail session.

The failure mode of a ban is that the person installs it anyway on their main profile, at home, on the machine they also use for work, and does not tell you. That is strictly worse than the sandbox.

If they push back with "the vendor fixed that," go read the fix with them. It is a good exercise. Half the time the fix is real and narrow, which is worth knowing, and the other half you will learn something about how this category of bug behaves. The same logic applies to any AI purchase: I have a list of questions worth asking before you pay for an AI tool, and for anyone in Europe, what to ask an EU-compliant AI vendor before signing.

When Does This Change

I do not know, and anyone who gives you a date is guessing.

But here is what I would watch for, because "never" is not the recommendation and I do not want to pretend it is. The recommendation is not in your main profile in 2026.

Watch for a real trust boundary inside the agent, where page content is structurally incapable of becoming an instruction, rather than a classifier that catches most attempts. Classifiers move 23.6% to 11.2%. Architecture moves it to zero. Watch for per-action scoping, where the agent gets a token for one task and one site rather than inheriting the whole session. Watch for vendors publishing attack success rates as a normal part of release notes, the way they publish benchmark scores now, so you can see the number move.

And watch the disclosure cadence. Right now, independent researchers are publishing a new class of these roughly every few months, and the fixes are getting bypassed inside the same disclosure cycle. When that slows down, something real has changed. It is the same dynamic I wrote about when attackers started finding bugs faster than anyone could patch them, except here the defender and the attacker are reading the same page.

My honest guess is that the enterprise version of this, with per-site scoping and audit logs, lands before the consumer version is trustworthy. Which would be a first.

Until then: sandbox profile, no company accounts in it, and one paragraph written down. If you want help sorting out which parts of your stack are actually exposed, that is the kind of unglamorous work I do at Wunderlandmedia.