Security Flaws in Agentic AI Browsers Expose Users to Cyber Risks, University of Washington Study Finds

Researchers at the University of Washington have identified significant security flaws in several popular AI-powered web browsers, demonstrating that these systems can be exploited to bypass the web’s core data-isolation safeguards. The study, which evaluated seven different agentic AI browsers, revealed that four of them fail to properly enforce the same-origin policy, a fundamental security standard used to keep separate websites from accessing each other’s data. By executing a proof-of-concept prompt injection attack, the research team successfully forced an AI agent to extract sensitive data from an embedded webpage and transmit it to an external server.

How Agentic Browsers Bypass Web Security Controls

Modern web security relies on the same-origin policy, a security rule introduced in 1995 to keep websites sandboxed. Under normal conditions, if a user has an untrusted webpage open in one browser tab and their online bank account or personal email open in another, the browser prevents the untrusted site from reading or modifying the data in the secure tab. Even if a malicious site embeds a secure site inside an inline frame (iframe), the same-origin policy stops the two frames from interacting or sharing data.

The University of Washington researchers found that some agentic AI browsers—which use artificial intelligence to read, summarize, or take actions on webpages—compromise this boundary. Because the AI assistant is designed to read all content visible on a page to help the user, it can be instructed to cross origin lines.

When these browsers grant their underlying AI models direct access to the active webpage document, they essentially reduce the browser’s security to how well the AI model can resist malicious instructions. If the model is successfully manipulated by instructions written on a webpage, it acts as an intermediary, pulling data from a protected site and handing it to an attacker.

The Four Vulnerable Platforms and the Proof of Concept

The study, led by co-senior authors David Kohlbrenner and Franziska Roesner of the Paul G. Allen School of Computer Science & Engineering, evaluated the following seven systems:

• ChatGPT Atlas (evaluated both with and without “Agent Mode”)
• Chrome with Gemini
• Claude for Chrome
• Perplexity Comet
• Brave Leo AI
• Microsoft Edge with CoPilot
• Firefox AI Mode (with Claude selected as the agent)

Of these seven, the researchers found that ChatGPT Atlas (in Agent Mode), Chrome with Gemini, Claude for Chrome, and Perplexity Comet allowed their embedded AI agents to access cross-origin iframe content when prompted to perform tasks like summarizing a page.

The researchers demonstrated the vulnerability by designing a complete proof-of-concept attack on ChatGPT Atlas. In this scenario, the exploit flows through the following steps:

1. A user visits a malicious website that contains an embedded, hidden iframe of a sensitive site containing the user’s private data.
2. The malicious page also contains hidden text designed as a prompt injection.
3. When the user asks the browser’s AI assistant to summarize the active webpage, the AI agent reads the entire page, falls for the prompt injection instructions, and reads the private data from the embedded iframe.
4. The AI agent automatically inputs that sensitive data into a form on the attacker’s website.
5. The form then submits itself, sending the user’s private data directly to the attacker.

The team confirmed that while the complete attack was executed on ChatGPT Atlas, the necessary preconditions for the exact same cross-origin data theft also exist in Chrome with Gemini, Claude for Chrome, and Perplexity Comet.

Defensive Differences and Industry Responses

The researchers observed that the browsers with the most restrictive AI integrations remained secure. Firefox AI Mode, Brave Leo AI, and Microsoft Edge with CoPilot did not allow the AI agent to access cross-origin frames, protecting them from this style of data exfiltration. However, these stricter security boundaries also limit what the AI agent can read or do for the user.

The University of Washington team shared their findings with the developers of the affected browsers. According to the researchers, Anthropic and Firefox did not reply to the disclosures, while Perplexity and OpenAI declined the report.

The research team noted that there is currently no simple development fix that can fully secure these agentic systems against prompt injection attacks while preserving their broad reading and browsing capabilities. The team presented their findings on April 26, 2026, at the Agents in the Wild Workshop (held alongside the International Conference on Learning Representations, or ICLR 2026) in Rio de Janeiro.