Your AI Browser Can Act. That’s Exactly the Problem.
Not long ago I gave Perplexity’s Comet browser a spoken instruction – find my nearest recycling centre and book a slot – and it did, working through the council pages and completing the form without my touching a key. The experience captures why agentic browsing is compelling, and why it should worry every executive deploying it. A conventional browser displays hostile content. An agentic browser interprets hostile content and holds the tools to act on that interpretation – which resurrects the oldest problem in security: too much authority in the wrong hands.
The danger is no longer theoretical. In August 2025 Brave’s security team showed that a Comet user who simply asked the browser to summarise a Reddit thread could have their account hijacked: hidden instructions in a comment led the agent to open the user’s email, retrieve a one-time passcode and hand it to an attacker – a cross-domain takeover triggered by an ordinary summarise request. A follow-up in October smuggled the same class of instruction inside near-invisible text in a screenshot. Perplexity patched the flaw and, in December, open-sourced BrowseSafe, a detection model that scans pages for malicious instructions – while arguing for defence in depth rather than trust in any single model to catch every attack. That humility is warranted: an independent red-team bypassed the guardrail roughly a third of the time using simple encoding tricks.
The reason this is so stubborn is architectural. Large language models are built to treat language as instructions, and the web is language supplied by strangers. Separating “what the user asked me to do” from “what this page happens to say” is obvious to a human but must be engineered explicitly for a system that receives both as undifferentiated tokens. And the traps are already in the wild. An April 2026 study analysing 1.2 billion URLs across 24.8 million hosts identified more than fifteen thousand validated injection instances, roughly 70 per cent of them in non-rendered parts of pages – HTTP headers, comments, metadata – placed where no human would ever look because they were written for machines. Google’s own scanning found the malicious share rising 32 per cent over a single winter.
The strategic principle that follows is a division of authority: the agent can reason about what to do; it must not be the sole authority on what it is permitted to do. High-impact actions – anything that moves money, sends a message, changes a credential, or crosses into another authenticated domain – belong behind deterministic controls outside the model: allow-lists of domains, hard permission boundaries, transaction limits, and explicit human confirmation before irreversible steps. As Forcepoint’s researchers put it, a browser AI that can only summarise is low-risk, but one that can send emails, run commands, or process payments becomes a high-impact target. Capability and attack surface rise together.
For technology leaders piloting agentic browsers, three moves are now due diligence, not caution. First, inventory the agent’s reach: every authenticated session and system it can touch in a single context is the blast radius of one successful injection. Second, put irreversible and cross-domain actions behind deterministic gates and mandatory confirmation – this makes the agent feel fractionally less magical, and that is preferable to an autonomous purchase you did not sanction. Third, treat model-based detection such as BrowseSafe as one layer among several, never the perimeter, and assume a bypass rate above zero. The uncomfortable truth is that the more useful these agents become, the more damaging a single successful injection will be. Design for that asymmetry now, while the stakes are recycling slots rather than wire transfers.
Sources
Personal analysis. Views are mine, not my employer's.