AI browsers are being marketed as the next evolution in web browsing, capable of summarizing pages, booking trips, and even making purchases on behalf of users. However, a new study from the University of Washington has uncovered serious security flaws in several of these tools, raising questions about their safety. The research found that four out of seven popular AI browsers contain vulnerabilities that could allow malicious websites to steal data from other open tabs. The more capable the browser, the greater the risk appears to be.
The 30-Year Security Rule That AI Browsers Are Breaking
Since 1995, every major web browser has adhered to a fundamental security principle known as the same-origin policy. This rule prevents websites from accessing data from other websites, ensuring that if a user has a bank account open in one tab and visits a sketchy site in another, that sketchy site cannot read the banking information. The same-origin policy is a cornerstone of web security, protecting sensitive data like passwords, emails, and financial records.
AI browsers, however, require the ability to interact across multiple tabs to perform complex tasks, such as summarizing content from different sources or making bookings that involve cross-site data access. To do this, they must bypass the same-origin policy. This broader access is exactly what attackers can exploit through two primary methods: prompt injection and memory poisoning.
Prompt injection occurs when a malicious webpage hides secret instructions within its content. The AI agent, designed to read and act on page content, follows these instructions without realizing it has been manipulated. This can expose private emails, passwords, or calendar details stored in other tabs. Memory poisoning is even more insidious, as planted instructions get stored in the agent's memory and activate later, even after the original page is closed. The researchers successfully demonstrated a proof-of-concept attack on ChatGPT Atlas, confirming that the risk is real.
Which AI Browsers Are Vulnerable?
The study tested seven AI browsers: ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, Perplexity Comet, Microsoft Edge with Copilot, Brave Leo, and Firefox AI Mode. The first four were found to be vulnerable to attacks. Claude for Chrome was flagged as particularly risky because its browser extension design allows it to inject code directly into webpages, giving attackers a wide opening for exploitation. In contrast, Microsoft Edge with Copilot, Brave Leo, and Firefox AI Mode showed stronger security properties. However, Firefox was also the most limited in capability, raising the question of whether security is being sacrificed for functionality.
The researchers disclosed their findings to all companies involved. Anthropic and Firefox did not respond. Perplexity and OpenAI declined to act, arguing the researchers lacked a complete end-to-end attack demonstration. Google, Microsoft, and Brave engaged constructively with the findings, indicating a willingness to address the issues.
Broader Implications for AI Security
This study follows a recent exploit called BioShocking, which demonstrated how AI browsers can be manipulated by context. The underlying problem is that AI agents must break fundamental web security rules to function effectively, creating a tension between utility and safety. The same-origin policy was designed for a world where browsers passively display content, not one where they actively execute tasks across multiple origins. As AI browsers become more sophisticated, the attack surface expands.
Prompt injection and memory poisoning are not new concepts in AI security, but their application to browsers introduces a new vector for data theft. In a prompt injection attack, the malicious page can disguise instructions as normal text, such as a fake ad or button. The AI agent, trained to follow user intent, can be tricked into performing actions like forwarding emails or revealing personal information. Memory poisoning takes advantage of the agent's ability to learn from past interactions. Once a planted instruction is stored, it can trigger anytime the agent encounters a similar context, even days later.
The findings highlight a broader issue: AI development is outpacing security measures. Companies are rushing to release AI-powered features without fully vetting their implications. The same-origin policy has been a bedrock of web security for nearly three decades, and breaking it without robust safeguards is risky. The researchers emphasize that the more capable an AI browser is, the more access it requires, and the more damage a compromised agent can do.
Historically, web security has evolved through a combination of browser-level protections and user awareness. The introduction of extensions, JavaScript, and cross-origin requests all required careful security modeling. Now, AI agents add a new layer of complexity. They are not just executing code but interpreting natural language, making them susceptible to semantic attacks that traditional browsers could ignore. For example, a malicious site could embed a command in a paragraph that the AI reads and acts upon, while a human user would simply see text.
The research also raises questions about user trust. When users install an AI browser extension, they are granting it extensive permissions to read and modify page content. Most users are unaware that this breaks the same-origin policy. Security warnings in browsers often alert users when a site tries to access data from another site, but AI agents can bypass these prompts because they operate at a higher level of abstraction.
Looking ahead, the industry needs to develop new security models for AI agents. Some suggestions include sandboxing agent actions, requiring explicit user confirmation for cross-origin data access, and limiting memory retention of sensitive information. Until such measures are implemented, users should be cautious about granting AI browsers full access to their browsing sessions. The study concludes with a stark observation: AI browsers are moving faster than their security can keep up, and the hype surrounding them may be blinding both users and developers to the real dangers.
Source: Digital Trends News