This year, AI browser agents, tools that can navigate websites, do tasks, and fill out forms on your behalf, went from being new to really helpful. With minimal assistance, ChatGPT Atlas, Perplexity’s Comet, Opera’s Neon, and Claude’s browser tools may now summarise your email, make reservations, or buy for you. It’s really convenient. Thus, the risk is growing.
The Threat Has a Name, Prompt Injection
The key security issue of the agentic AI era is prompt insertion, which ceased to be theoretical in 2026. Prompt injection attacks have increased 340% year over year, making them the fastest-growing category of cyberattacks detected worldwide, according to OWASP’s 2026 LLM Security Report.
It is difficult to completely correct because of the mechanism’s simplicity. When an agent browses the web, they consider the content of pages to be more than just a display; they are something to read and act upon. When an attacker conceals instructions within a webpage, such as in white text on a white backdrop, inside an HTML remark, or inside a document that the agent is asked to summarise, the agent is unable to distinguish between your instructions and the attacker’s when processing that page.
This Has Already Happened, Repeatedly
These are no longer speculative demos. Brave’s security team revealed an exploit in which Perplexity’s Comet browser extracted a one-time password from an unrelated tab due to hidden instructions within a Reddit spoiler tag. Every major AI browser tested, including Opera’s Neon, Perplexity’s Comet, and ChatGPT Atlas, was shown to be susceptible to prompt injection at Black Hat USA 2026.
Additionally, browsers are not the only ones at risk. According to OWASP’s 2026 findings, coding agents are a significant source of actual occurrences, such as one in which a hacked automation tool released backdoored software packages without a human being in charge of the attack after it started; the malicious activity spread on its own.
Why This Is Hard to Fully Solve
Research on hardening agents against quick injection has been published by all of the major AI labs developing these tools, including Anthropic and OpenAI, and significant advancements have been made.
Since the agent’s primary function, acting independently on untrusted online content, is also what generates the vulnerability, the businesses developing these systems are honest in saying that the issue isn’t entirely resolved and may not have a perfect solution.
Reducing an agent’s autonomy lowers risk, but it also diminishes the agent’s initial utility; this is a true trade-off rather than merely an engineering gap that needs to be filled.
What This Means If You Use These Tools
You don’t need to avoid AI browser agents entirely, but a few habits meaningfully reduce your exposure:
- Avoid connecting browser agents to your most sensitive accounts (banking, primary email) unless the task genuinely requires it.
- Be cautious asking an agent to “summarize” or “process” content from sources you don’t control – that’s the exact vector attackers use.
- Review what permissions and account access an agent actually has, and scope it down to what a task needs, not what’s convenient.
- Treat unexpected agent behaviour – an odd action, an unrequested page visit – as a signal worth investigating, not a glitch to ignore.
What This Means If You’re Building With Agents
- Apply privilege separation – limit exactly what actions and data an agent can touch, so a successful injection has a small blast radius.
- Treat all web and document content the agent processes as untrusted input, not just user prompts.
- Red-team your agent against injection attempts on a recurring schedule, not just before launch.
- Keep a human in the loop for any action with real financial, legal, or data-exposure consequences.
The Bottom Line
In 2026, AI browser agents surpassed a genuine utility barrier, and attackers became aware at the same time as consumers. This is not a reason to stay away from the technology, but it is a reason to handle it as you would any tool that has extensive access to your accounts: with real scoping, real caution about what it is exposed to, and realistic expectations that the security issue is still being actively worked out rather than resolved.
Crunch Brief covers the security stories that matter for anyone building with or using AI , subscribe for the weekly rundown.
