Agentic browsers reduce the same-origin policy to the strength of their prompt-injection defenses

Franziska Roesner and David Kohlbrenner tested seven agentic browsers in late January and early February 2026 and published their results through the University of Washington agent-security group. Their central finding is narrow and consequential: in several of these products, the same-origin policy is reduced to the strength of the agent’s defenses against prompt injection. They demonstrated a full cross-origin data theft against ChatGPT Atlas in Agent Mode.

That sentence describes a change to the browser threat model, not a single patchable bug. The browser enforces the same-origin policy below the page, so no amount of persuasive text on a malicious site can move it. An agent that reads page content and acts with your logged-in session relocates that boundary into a model’s context window, where it now depends on the model separating data from instructions correctly every time.

What the same-origin policy guaranteed before agents

The same-origin policy stops content from one origin reading or changing content from another. The UW authors put it plainly: if a user opens attacker.com alongside a tab loading bank.com, the attacker cannot reach the bank’s page or its stored cookies. Even when the attacker embeds bank.com in an iframe, neither frame can read or interact with the other unless both sides explicitly allow it.

• Read isolation: script on attacker.com cannot read the DOM, text, or cookies belonging to bank.com.
• Action isolation: script on attacker.com cannot click buttons or submit forms inside an embedded bank.com frame.
• Credential scoping: your bank session travels with requests to bank.com, and the attacker’s script cannot read what comes back.

Those three properties hold regardless of how convincing the attacker’s page is, because a browser engine and not a language model decides them. Web developers have built two decades of assumptions on top of that. An agentic browser breaks the assumption without changing a line of the specification.

Why an agent with your session becomes a cross-origin read and write primitive

The agent sits above the origin boundary rather than inside it. In the least restrictive designs it reads rendered content across frames and tabs while acting with the user’s authenticated privileges, so a successful prompt injection converts plain text on an attacker’s page into cross-origin reads and writes. Brave’s security team described the same collapse: protections such as the same-origin policy become irrelevant once the assistant executes as the logged-in user.

1. The user visits the attacker’s page.
2. That page loads a cross-origin iframe pointing at a sensitive site where the user already holds a session.
3. The user asks the agent to summarize the page.
4. The agent reads the page and absorbs the injected instruction, which tells it to include the embedded iframe in the summary and enter that summary into the page’s form.
5. The agent writes the summary, now carrying cross-origin content, into the attacker-controlled form.
6. The form submits automatically and the data reaches the attacker.

The UW authors are careful about preconditions. In modern browsers this version of the attack also needs the sensitive page to permit framing and to use a non-strict third-party cookie policy. They note the chain runs in the other direction too, where a malicious embedded frame such as an ad reads the sensitive parent page that hosts it.

Nothing here exploits memory corruption or a broken TLS check. The attacker supplies text and the agent supplies privilege, which is the classic confused-deputy shape. We covered the same pattern in tooling rather than pages in MCP tool poisoning and the agent supply chain.

What the seven-browser test actually found

Design decisions vary widely across the category, and exposure varies with them. The UW team tested Brave Leo AI, ChatGPT Atlas with and without Agent Mode, Chrome with Gemini, Anthropic’s Claude for Chrome, Microsoft Edge with Copilot, Firefox AI Mode running Claude, and Perplexity Comet, using the stable release of each on macOS Sequoia at the time of testing.

• They demonstrated a working cross-origin data theft against ChatGPT Atlas in Agent Mode.
• They found the preconditions for that same attack, contingent on a successful prompt injection, in Chrome with Gemini, Anthropic’s Claude for Chrome, and Perplexity Comet.
• They identified agents able to read masked user input such as password fields.
• They documented preconditions for two further attack concepts: cross-origin action forgery and chat memory poisoning.
• They judged Brave, Edge, and Firefox to have more limited agentic features and stronger security properties at the time of testing.

The disclosure record deserves attention before anyone treats this as resolved. The researchers notified Anthropic, Brave, Firefox, Google, Microsoft, OpenAI, and Perplexity more than 60 days before publication. Brave, Google, and Microsoft acknowledged and responded. OpenAI and Firefox declined the report on the grounds that the researchers had not built a full end-to-end prompt injection attack, and Anthropic had not replied when the paper was written.

The team singled out Claude for Chrome for particular caution, because it ships as a browser extension and can inject JavaScript into pages. Capability and blast radius move together, and the most useful configuration is usually the most exposed one.

Process isolation does not close a semantic trust boundary

OpenAI did substantial isolation engineering on Atlas, and the UW attack still worked. Ken Rockot and Ben Goodger described OWL, OpenAI’s Web Layer, which runs Chromium’s browser process outside the main Atlas application process and communicates with it over Mojo IPC rather than embedding Chromium inside the app.

The agent-mode details matter more than the headline architecture. OpenAI routes agent-generated input events straight to the renderer instead of through the privileged browser layer, which preserves the sandbox boundary under automated control. Logged-out agent sessions get isolated in-memory stores through Chromium’s StoragePartition, and each session discards its cookies and site data when it ends.

Those controls harden process boundaries and storage boundaries. They do not touch the boundary the attack crosses, which is the line between the user’s instruction and the page’s text inside a single context window. A model that cannot tell those apart will act on both, whichever operating system process happens to host it.

• Process boundary: which process runs the web engine. OWL moves this, and moving it changes nothing about prompt injection.
• Session boundary: which credentials the agent can reach. Logged-out mode moves this, which lowers the payoff of an injection without preventing one.
• Instruction boundary: whether the model treats page text as data or as a command. OpenAI, Brave, and Perplexity each describe this boundary as unsolved.

Three vendors have said in writing that this attack class is unsolved

You do not have to infer the risk from academic work alone. The companies shipping these features published the same conclusion in their own words, which makes it fair to quote back during a procurement conversation.

• OpenAI’s chief information security officer Dane Stuckey wrote that “prompt injection remains a frontier, unsolved security problem, and our adversaries will spend significant time and resources to find ways to make ChatGPT agent fall for these attacks,” quoted by The Register and annotated point by point by Simon Willison. OpenAI’s own explainer calls it a frontier security challenge.
• Brave’s Artem Chaikin and Shivan Kaul Sahib concluded that indirect prompt injection is “a systemic challenge facing the entire category of AI-powered browsers” after testing several implementations, including instructions hidden in screenshots as faint text a person cannot see but the browser’s text recognition extracts and hands to the model as if it were the user’s query.
• Perplexity’s security team wrote that the problem “demands rethinking security from the ground up” and that these attacks “manipulate the AI’s decision-making process itself, turning the agent’s capabilities against its user,” in its post on mitigating prompt injection in Comet.

Each vendor also shipped mitigations, and those mitigations are not equivalent. OpenAI added logged-out mode plus a watch mode that pauses the agent on sensitive sites when you leave the tab. Perplexity built a four-layer defense whose classifiers scan retrieved content before the agent acts, later released as BrowseSafe and audited by Trail of Bits. Brave recommends isolating agentic browsing from regular browsing outright.

Read all of that as risk reduction rather than elimination. OpenAI’s later post on continuously hardening Atlas states that prompt injection is unlikely to ever be fully solved, and frames the work as a rapid-response loop that raises the cost of exploitation over time.

Where this sits in the OWASP agentic top 10

The OWASP GenAI Security Project published its Top 10 for Agentic Applications on December 9, 2025, and this attack maps onto three of its entries. Using shared identifiers makes vendor answers comparable across products instead of leaving each response in its own vocabulary.

• ASI01 Agent Goal Hijack covers the entry point, where attacker-supplied content redirects the agent away from what the user asked. OWASP’s launch note cites EchoLeak as its reference incident.
• ASI06 Memory and Context Poisoning covers persistence, which lines up exactly with the chat memory poisoning precondition the UW team observed.
• ASI03 Identity and Privilege Abuse explains why the attack pays off at all: the agent operates with the user’s session instead of its own scoped, short-lived credential.

For the full ten items turned into procurement language, use our OWASP agentic top 10 vendor rubric. For scoring the answers rather than merely collecting them, our agent evaluation framework covers how to weight a vendor response you cannot independently test.

Questions to ask before you enable agent mode

Ask these in writing and keep the answers with your vendor file. Scope them across the same surfaces you already track for agent connectivity, including MCP servers and remote tool endpoints. A vendor who cannot answer question three is telling you the instruction boundary is undefined.

1. Which origins can the agent read in a single turn, including iframes, background tabs, browser history, and stored page memories? Ask for the explicit list rather than a summary.
2. Can the agent read masked input such as password fields, and if it can, what suppresses that behavior?
3. How does the system separate the user’s instruction from page text? Is that separation structural, or is it a prompt instruction the model can be argued out of?
4. Does agent mode start with the user’s live session by default, or does it start logged out and require an explicit escalation with an audit record?
5. Which actions require human confirmation, who defines that list, and can an administrator extend it to our own internal domains?
6. Can the agent write page content into persistent memory, and can an administrator disable that write path per tenant?
7. What does the product log for agent actions, and can those logs reach our SIEM carrying the origin, the action taken, and the content that triggered it?
8. Has an independent third party tested the agent against prompt injection? Ask for the report and the disclosure timeline, not a summary slide.
9. How did you respond to the University of Washington disclosure, and what specifically changed in the product afterward?
10. What is the kill switch, who can pull it, and does it work without the agent’s cooperation?

Two of those matter more than the rest for most teams. Question four decides whether one injection reaches real accounts, and question five decides whether it can finish the job. Intuit’s approach to human review inside agent workflows is a useful reference for where confirmation gates belong when the agent already holds real authority.

Controls you can apply without waiting for a vendor roadmap

Assume the instruction boundary will fail occasionally and design for blast radius instead. Every item below sits on your side of the contract, so none of it depends on a release note.

• Keep agent mode logged out by default and require a named approval before anyone runs it against authenticated sites.
• Separate the browser profile used for agentic work from the profile holding email, banking, and admin consoles.
• Block agent mode on your highest-value internal applications at the policy layer rather than relying on individual judgment.
• Set Content-Security-Policy frame-ancestors and strict SameSite cookies on the apps you own, which removes the framing and third-party cookie preconditions the UW attack depends on.
• Treat agent chat memory as untrusted storage: review what it retains, expire it on a schedule, and test that clearing it actually clears it.
• Log agent-initiated actions separately from human actions so an investigator can tell the two apart later.

None of that is exotic. It is the same containment logic we applied after the 2026 evaluation escapes in our agent-security checklist, with the full incident narrative in when AI safety tests escape the sandbox.

The data question sits right next to the security question

Even with no attacker involved, an agentic browser sends more of your screen to a vendor. Lena Cohen, a staff technologist at the Electronic Frontier Foundation, told TIME that Atlas gets access to a lot more information than other browsers, and that the information Atlas accesses can be used to train OpenAI’s models.

TIME reported that Atlas turns on the “Improve the model for everyone” setting by default while leaving the broader “Include web browsing” option off by default. Check both per user, then check them again after updates, because defaults drift quietly. A feature name is not a guarantee, which is the point we made when Private Relay leaked real IP addresses.

This is also why the category question outranks the product question right now. As personal AI agents move toward being a default, the browser becomes the one place where your most sensitive sessions and the most untrusted content in the world sit in the same window.

What to do next

Agentic browsing is worth piloting and not worth defaulting on. Run it logged out, on a separate profile, against a short list of low-value tasks, and make one person accountable for the ten answers above. Capability rankings will not surface any of this, which is the same caution we raised about reading AI leaderboards.

Compare the profiles for ChatGPT, Claude, Gemini, Perplexity, and Microsoft Copilot, save a shortlist, and re-open it whenever a vendor changes an agent default. If you are scheduling API work this year as well, our OpenAI 2026 deprecation and migration playbook covers the other change your roadmap needs to absorb.