Security researchers say they found around 20 flaws across AI-enabled browsers and extensions, including products associated with OpenAI, Google, Anthropic, Microsoft and Perplexity. The demonstrations included access to local files, password-manager compromise, browsing-history exposure and actions performed through logged-in accounts. The findings show why adding an agent to a browser changes the browser’s security model.
Zenity researchers presented the work at a security conference. Their tests included OpenAI’s Atlas, which the company was reportedly preparing to discontinue. Wired describes examples in which manipulated content caused the browser to send WhatsApp messages or make an unauthorized Amazon purchase. These were controlled proofs of concept, not evidence that every user experienced those attacks.
Agents collapse boundaries browsers spent decades building
Traditional browsers separate websites through controls such as the same-origin policy. A page should not be able to read data from another service merely because both are open. An AI agent, however, may be authorized to observe several tabs, interpret page content and act across accounts on the user’s behalf.
That broad perspective is the product’s appeal. It is also a route around boundaries. Malicious instructions embedded in a page or post can influence an agent that has access to email, shopping and messaging. The attacker no longer needs conventional code execution if the assistant can be persuaded to perform the action through legitimate interfaces.
Zenity chief technology officer Michael Bargury argued that AI integrations have weakened protections and revived attack patterns associated with much earlier browsers. That is a researcher’s characterization, but the demonstrations support the narrower point that agent permissions create new cross-site risks.
Prompt injection is a permissions problem
Developers often try to solve malicious instructions by asking another model to classify content as safe or unsafe. Researchers warn that these judgments can frequently be bypassed. Natural language has too many ambiguous forms for one probabilistic filter to serve as the only security boundary.
The more durable approach is architectural. A browser should distinguish user instructions from webpage content, restrict which sites an agent can control and require confirmation before consequential actions. Access to passwords, payments, files and messages should never be bundled into a general permission to “browse.”
Atlas reportedly had comparatively strong boundaries among the products tested, yet researchers still found ways around them. That suggests security cannot be reduced to selecting a better model. The surrounding software, credentials and user interface determine the damage a compromised agent can cause.
Extensions deserve the same scrutiny as dedicated browsers. An add-on may inherit access to pages and accounts inside a mature browser while introducing an agent layer whose data flows and remote services are less visible to the user.
Useful browser agents need constrained agency
The industry faces a product trade-off. An assistant that constantly asks for confirmation becomes tedious, while one that operates silently can turn a misleading page into an account takeover. Context-sensitive controls are needed: low-risk navigation may proceed automatically, but purchases, outbound messages and credential access should require explicit review.
Users also need previews that show the intended action and its destination without relying on an AI-generated summary. Logs should make it possible to see which content influenced the agent and undo reversible changes.
The source does not establish that AI browsers are uniquely impossible to secure. It establishes that familiar web assumptions do not automatically survive when a model can read and act across services. Vendors must test the full chain rather than advertise the assistant’s intelligence as a substitute for isolation.
Browser agents promise to remove repetitive work from the web. To earn that role, they must prove they can carry authority without treating every sentence on a page as a command. The safest agent will not be the one allowed to do everything. It will be the one whose limits remain intact when the web actively tries to confuse it.
