AI-Powered Browsers Threaten Your Data: Study Reveals Major Security Flaws

AI‑Enhanced Browsers Grow Faster Than Their Security Foundations

In the past twelve months, a wave of web browsers that embed artificial‑intelligence agents has hit the market. These agents can be asked to arrange travel itineraries, locate dining options, book reservations, and even add events to a user’s calendar, all while opening multiple tabs behind the scenes. Performance varies widely across products.

University of Washington Study Highlights Critical Weaknesses

A team at the University of Washington examined seven widely used AI‑driven browsers and discovered that four of them allow attackers to sidestep the “same‑origin policy,” a cornerstone rule that prevents webpages from accessing each other’s data.

Experts Caution Against Premature Public Release

“Browser agents aren’t ready for the public,” warned David Kohlbrenner, an assistant professor in the Paul G. Allen School of Computer Science & Engineering and co‑senior author of the study. “Even if you’re a relatively savvy user, if these agents have access to a browser that contains your credentials—your email, your bank account, whatever it is—you should not trust that these systems are ready to truly protect your information. They may get there in time, but they’re not there yet.”

Franziska Roesner, a co‑senior author and professor in the same school, added, “This policy is fundamental to how modern browsers protect your information. When I used the web in the 1990s, I had to be very careful about what websites I visited. Just visiting a bad website could make you susceptible to a cyberattack. But browser security has evolved over the past 30 years to the point where you can safely visit just about any website.”

Same‑Origin Policy: A 1995 Safeguard Under Pressure

First introduced in 1995, the same‑origin policy isolates data across distinct domains, preventing a site opened in one tab from reading or manipulating the content of another. This isolation allows users to browse insecure pages while remaining logged into sensitive services, such as online banking, without exposing credentials.

How AI Agents Can Be Tricked

When agents receive access levels comparable to human users, they become vulnerable to attacks that ordinary users typically avoid. Kohlbrenner explained, “To some extent, it’s the same attacks you would do against a human, but tailored for machines. AI agent security measures are evolving, but they’re still open to attacks that human users wouldn’t fall for.”

The study’s proof‑of‑concept builds on “prompt injection,” where hidden code on a malicious page feeds deceptive instructions to the agent. For example, a safe site might be asked to summarize its content, while an embedded malicious snippet could command the agent to include that summary in a form submission, effectively leaking user data to the attacker.

Another identified threat is “memory poisoning.” Because agents retain and compress information to improve future responses, they may inadvertently blend data from different origins. Roesner noted, “We found that some of these agents would mingle information from different origins, likely because they were revising and compressing their memory.” This blending could allow a later request to retrieve sensitive details that were originally captured on a different site.

Company Reactions and Open Challenges

The researchers shared their findings with the developers of the tested browsers. Anthropic and Mozilla’s Firefox team did not reply, while Perplexity and OpenAI declined to comment. The least permissive browser in the sample, Firefox AI Mode, also offered the most limited functionality, highlighting a trade‑off between capability and safety.

Roesner said, “We’ve had some really good exchanges with folks at Google, Microsoft, and Brave. Companies are pushing out these browsers because they’re under competitive pressure. But how to make them safe is still an open question. After 30 years of building up this same‑origin policy, this is a big step back for browser security.”

Funding and Further Reading

The research received partial support from contributions by Microsoft.