Agentic Browsers: When Your AI Assistant Has a Cursor

For twenty years the browser threat model assumed a human at the keyboard. Same-origin policy, CSRF tokens, SameSite cookies, phishing training — every control quietly depended on a person choosing what to click. In 2026 that assumption no longer holds. Agentic browsers — Perplexity's Comet, The Browser Company's Dia, OpenAI's Operator, Anthropic's Computer Use, and a growing shelf of enterprise variants — put a language model in the driver's seat of a logged-in session.

The productivity story is real. The security story is that every one of those agents will happily read a webpage, interpret a paragraph of text as an instruction, and act on it inside the user's authenticated context. Indirect prompt injection stops being an academic paper and becomes a session-hijack primitive.

The new attack shape

Traditional web attacks needed the victim to click. Agentic-browser attacks need the victim's agent to *read*. The payload is prose:

• Comment-field injections. A Zendesk ticket, GitHub issue, or product review contains instructions addressed to "the assistant reading this page."
• Invisible-text injections. White-on-white or 1px text the human never sees but the agent's DOM reader ingests.
• Screenshot injections. For vision-based agents, adversarial text rendered as an image inside an otherwise innocuous page.
• Tool-description injections. In MCP-connected setups, a compromised tool describes itself with hidden instructions the model treats as system-level.

Brave's security team published working PoCs against Comet in August 2025 showing exactly this pattern: a page instructs the agent to open the user's mail, exfiltrate a 2FA code, and post it back to an attacker endpoint — all inside the user's own session.

Why classical defenses miss

• Same-origin policy protects one origin from another. It does not protect the user from their own agent acting on their behalf across origins.
• CSRF tokens assume a forged request from a foreign origin. The agent's request is *not* forged; it carries the real session cookie and originates from the real browser.
• SameSite cookies likewise treat the agent as first-party.
• Phishing training assumes a human evaluates the URL bar. The agent does not.
• DLP watching for exfil traffic sees the agent's traffic as user traffic.

Controls that actually help

The emerging playbook, drawn from OWASP's 2025 LLM Top 10 update (LLM01 Prompt Injection, LLM06 Excessive Agency) and from vendor guidance shipped alongside Operator and Computer Use:

• Human-in-the-loop for state-changing actions. Read-only browsing is comparatively safe; sending mail, moving money, modifying records must require an out-of-band confirmation.
• Domain allow-lists per task. Scope each agent run to the domains the task legitimately needs. "Book a flight" does not need access to the user's inbox.
• Separate identity for the agent. Give the agent its own account with least-privilege access, not the user's admin session.
• Content provenance separation. Treat any text pulled from a webpage as *data*, never as instructions. Vendor SDKs are starting to expose explicit `<untrusted_content>` delimiters — use them.
• Egress monitoring on the agent process. Log every outbound request the agent initiates; alert on new domains.
• Kill-switch and session TTL. Short-lived agent sessions with a visible stop control; no persistent background agents.

Regulatory and standards backdrop

• OWASP LLM Top 10 (2025). LLM06 Excessive Agency is the single most-cited category in 2026 incident write-ups.
• NIST AI 600-1 (Generative AI Profile). Adds explicit guidance on agentic systems and tool use.
• EU AI Act, Article 15. Cybersecurity requirements now interpreted by several national authorities to include agentic-execution safeguards.
• UK NCSC / CISA joint guidance on secure AI system development (2025 revision). New section on autonomous agents.

The uncomfortable prediction

The first widely-reported agentic-browser breach — an assistant that empties a corporate inbox, wires funds, or leaks a merger deck because a webpage told it to — is a matter of when, not if. The organizations that fare well will be the ones that treated their agent like a junior employee with root access from day one: scoped permissions, mandatory approvals for anything irreversible, and a boss who reads the logs.

Your agent is a confused deputy with your session cookie. Design the system as if it will be tricked, because it will be.