AI agents that browse, click, fill forms and buy now inherit their owners’ logged-in sessions. That convenience creates an unresolved security problem: prompt injection, where hidden text in a webpage, email, document or image is read as an instruction. The result is an attack surface inside the bank, inbox and cart.
- OWASP ranks it first: Prompt injection is LLM01:2025 in the OWASP Top 10 for LLM applications. The indirect form arrives through websites, files and other external content.
- Permissions follow the session: The UK NCSC advises assuming the model can be manipulated and measuring impact as if an attacker held every tool the agent can use.
- Vendor guards are partial: Anthropic, Google and OpenAI have added approval gates, but all call prompt injection an ongoing risk rather than a solved bug.
Why prompt injection is not a normal patch
Prompt injection is not a traditional programming flaw. The UK National Cyber Security Centre explained in December 2025 that language models “do not enforce a security boundary between instructions and data inside a prompt.” SQL injection was contained by separating code from data; with LLMs, both arrive as text. The NCSC warns the attack may never be fully mitigated and urges caution around any product claiming to stop it outright.
“It is unlikely that prompt injection, like scams and social engineering on the web, will ever be completely solved.” — OpenAI, December 2025
OWASP adds that injected instructions need not be visible. A shopper may see an ordinary review while the agent reads different commands hidden in images or page content.
Anthropic reports that Claude Opus 4.5 and new safeguards cut attack success to 1% in internal tests with an adaptive attacker making 100 attempts per environment — still a “significant risk.” OpenAI says real-world attacks increasingly resemble social engineering and reported a 2025 ChatGPT attack that worked 50% of the time in tests.
The permission problem: your agent inherits your sessions
A browser agent can do what you can do in the browser where it is installed. If you are signed into banking, email or a store with a saved card, the agent acts inside those sessions. The NCSC’s rule is blunt: assume manipulation is possible, then measure the blast radius from every tool the agent can reach. Each new connector adds another door.
Claude in Chrome, now available on paid plans, starts in an “auto-approve” mode where Claude decides when to ask permission; Anthropic recommends manual approval and strongly discourages use for finances, legal documents or medical information. Chrome with Gemini asks for confirmation before sensitive sites, password-manager sign-ins and purchases; a second model isolated from web content reviews proposed actions. Google brought auto browse to Android in August 2026 for US subscribers.
OpenAI retired its ChatGPT Atlas browser, scheduled to close on August 9, 2026, and moved agent browsing into the ChatGPT desktop app and Chrome extension. It advises logged-out mode when a session is unnecessary, narrow tasks and careful review of confirmation requests. Its optional Lockdown Mode disables agent mode, limits live browsing to cached content and blocks many external connectors to reduce data exfiltration.
Defenses that limit the damage
No single measure eliminates prompt injection. Each reduces what an attacker can accomplish if the agent is tricked. Gartner’s AI TRiSM guidance points to distinct agent identities, task-scoped permissions, tool allowlists, short-lived credentials and approval gates for consequential actions.
- Use a separate browser profile without banking, health or government sessions. If the agent falls for a trap, it finds nothing valuable open.
- Assign closed tasks. “Find Madrid–Lisbon flights from the 3rd to the 7th and show the three cheapest” leaves less room than “plan my trip.”
- Keep final payment manual. Let the agent prepare the cart; confirm the purchase yourself.
- Watch for strange behavior. Stop if the agent changes subject, visits unexpected sites or asks for sensitive data such as a password or SMS code.
- Never dictate passwords in chat. Let the password manager fill credentials, or type them yourself.
A September 2026 Salesforce Agentforce case, SalesBleed, showed how instructions planted in a public lead form could make an agent query and exfiltrate data; Salesforce fixed it and reported no exploitation.
TechNews DevTop’s assessment: the industry sells delegation while shipping homework. Marketing promises an assistant that buys and books; safety documentation asks users to approve every step, avoid banking and distrust whatever the agent reads. Until independent auditors measure attack success across real browsing tasks, a shopping agent deserves the trust of a first-day intern: useful for research, but never handed the card.