Browser-Use Agents: The Security Tightrope

The Rise of Agentic Browsers—And Why Traditional Security Fails Them

In 2025, the browser stopped being something you operate and became something that operates for you. AI agents that book flights, fill forms, and shop autonomously shipped inside Chrome, Edge, Perplexity's Comet, Brave, Opera, and OpenAI's Atlas — moving, as Wiz's year-end review puts it, from prototype to production almost overnight.

The scale is hard to overstate. Chrome, which holds 65% of global browser share, is adding Gemini-powered agentic browsing, while Edge for Business ships Copilot Mode wired into Microsoft Graph. OpenAI's Atlas racked up 62x more corporate downloads than Comet in its first week, and 27.7% of organizations already had Atlas users by October 2025.

Here's the problem: your instincts about web security were built for a world of scripts and sandboxing — not for an AI reading your screen with your login sessions. The core unsolved issue is that LLMs cannot reliably distinguish your trusted instructions from malicious commands hidden in web content, something OpenAI's CISO has called "a frontier, unsolved security problem." Prompt injection now ranks #1 on OWASP's LLM Top 10.

Brave's security team demonstrated why the old defenses don't apply. In research on Comet, they showed that same-origin policy and CORS — the bedrock of web security for two decades — are effectively useless when an AI assistant follows malicious instructions from an untrusted page, because the agent operates with your full privileges across authenticated sessions.

The academic record backs this up. A systematic study of eight browser agents found 30 privacy vulnerabilities — at least one in every single agent tested. The researchers noted these agents are often built by teams without browser-security expertise, so small configuration decisions can have enormous unintended privacy consequences.

Worse, the attack surface extends beyond anything a human can see:

• Invisible white-on-white text, tiny fonts, and off-screen content that agents read but you never notice
• HTML comments, image metadata, and PDF fields carrying hidden instructions
• Pixel-level perturbations — the "WebInject" technique that manipulates the very screenshot the AI sees

The uncomfortable takeaway: every input an agent consumes is untrusted input — including the skills and instruction packages you load into it. That's the same discipline SkillzBench is building into its free skills directory, security-scanning and version-pinning every skill before an agent ever sees it. The technology is worth adopting; the assumption that anything is safe by default is not.

The Attack Playbook: Prompt Injection, Hidden Text, and Zero-Click Threats

The 2025 landscape for browser-use agents has been defined by a relentless pace of security disclosures. From February through December, researchers revealed a near-monthly cadence of attacks, primarily exploiting indirect prompt injection vulnerabilities as documented by Wiz. This rapid evolution has outpaced traditional security frameworks, leaving many organizations exposed to threats they cannot easily detect or mitigate.

The core issue is that large language models struggle to distinguish between trusted user commands and malicious instructions embedded in web content. OpenAI’s CISO has publicly described prompt injection as a "frontier, unsolved security problem," highlighting the fundamental difficulty in securing autonomous systems according to recent analysis. Unlike traditional malware, these attacks do not require executing code or exploiting system endpoints. Instead, they manipulate the agent’s decision-making process using hidden text, HTML comments, or even pixel-level perturbations in images.

This manipulation is particularly effective because agents inherit the user’s full digital identity, including tokens and session cookies. Brave’s security team demonstrated that standard web security measures like same-origin policy become effectively useless when an AI assistant acts on untrusted instructions in their technical report. The attack surface extends beyond visible text to include invisible elements that humans ignore but AI vision models interpret. For instance, the academic technique known as WebInject perturbs raw pixel values to manipulate what the agent sees in screenshots, achieving high success rates while remaining stealthy as detailed in recent preprints.

The risk is not theoretical; it is already impacting enterprise environments. Prompt injection ranks #1 on OWASP’s LLM Top 10, signaling its critical importance per industry standards. Furthermore, data indicates that OpenAI’s Atlas browser is 90% more vulnerable to phishing than Chrome or Edge. With 27.7% of organizations reporting Atlas users, shadow adoption is likely occurring within your business without formal security review.

To manage this risk, organizations must treat every input an agent consumes as untrusted. This includes third-party tools and instruction packages that extend agent capabilities.

• Isolate agent contexts using dedicated browser profiles and avoid shared credentials.
• Maintain human-in-the-loop confirmations for all sensitive actions.
• Restrict agent access to low-stakes tasks to limit the potential blast radius.

SkillzBench is building a free directory and MCP connector to address this specific gap in agent skill security. By continuously scanning, version-pinning, and benchmarking skills, the platform ensures that only verified, secure instruction packages are loaded into your agents. This approach treats skill verification as a core security layer, rather than an afterthought, helping you deploy AI capabilities with confidence.

Defense-in-Depth: What Vendors Are Doing and What Actually Helps

No vendor has found a silver bullet, and the most telling sign is that all seven major players — Google, OpenAI, Anthropic, Perplexity, Brave, Opera, and The Browser Co. — have converged on the same answer: layer multiple imperfect defenses and hope no single attack slips through all of them. According to Wiz's year-end review, the industry has moved from simple "ask before acting" prompts to multi-layered architectures built around human-in-the-loop confirmations, reinforced-learning training, and secondary LLM critics that double-check an agent's intent before it acts.

Anthropic has set the transparency standard worth holding others to. In published testing data, the company showed prompt injection success rates cut nearly in half — from 23.6% to 11.2% — and a 1% attack success rate for Claude for Chrome against an adaptive attacker. Notably, Anthropic still describes that 1% figure as "meaningful risk," a refreshing contrast to vendors who publish unverifiable efficacy claims. The company also blocks its agent from financial, adult, and crypto sites, and concedes that "no browser agent is immune to prompt injection."

The layers stack like this:

• Human-in-the-loop confirmations before sensitive actions — the guardrail every vendor has adopted.
• Secondary "critic" models that review the agent's plan before execution.
• Reinforcement-learning training designed to make models resist malicious instructions.
• Site restrictions that keep agents away from high-stakes domains entirely.

One popular defense deserves special skepticism: sandboxing. Menlo Security's research shows an agent can be compromised by a document that never executes code at all — hidden white-on-white text, tiny fonts, or PDF metadata can redirect the agent into carrying out the attack. The file deploys no malware; its contents simply manipulate the agent. Sandboxing catches malicious code, not malicious prose.

Perhaps the most humbling finding: human security researchers consistently outperform automated systems at discovering creative attack vectors, per Anthropic's own testing. Automation helps, but creative adversaries still need creative defenders.

The same scrutiny applies to everything an agent consumes — including third-party skill packages and tools. That's the gap SkillzBench is building for: a free directory where every agent skill is version-pinned, license-checked, and security-scanned before it ever reaches your agent's context, with benchmarked lift published separately. If you're extending browser agents with skills, join the waitlist to evaluate them safely from day one.

Your Practical Playbook: Isolate, Approve, and Limit the Blast Radius

If you're going to let an AI agent loose on the web, the question isn't whether it will eventually encounter malicious content — it's what damage it can do when it does. That's why security experts converge on the same three-word playbook: isolate, approve, limit.

Wiz's year-end analysis of agentic browser security offers three practical rules for safe experimentation. First, isolate the context: run agents in dedicated browser profiles with no shared credentials, so a compromised agent can't inherit your logged-in sessions. This matters because agents operate with your full privileges across authenticated sessions — Brave's security team showed that same-origin policy and CORS protections are "effectively useless" once an assistant follows malicious instructions from a webpage. Second, never disable human-in-the-loop confirmations, the one guardrail every major vendor has converged on. Third, restrict agents to low-stakes tasks to limit the blast radius of any failure.

Beyond those rules, three habits separate cautious adopters from exposed ones:

• Keep sensitive workflows off agentic browsers — finance, HR, and authentication systems stay human-only until defenses mature.
• Monitor shadow adoption. Cyberhaven data found 27.7% of organizations already have Atlas users, often without IT's blessing.
• Build an AI-agent-specific incident response playbook before you need it.
• Treat every skill, tool, or instruction package an agent consumes as untrusted input — scan and validate it before it reaches the agent's context.

That last point extends beyond browsers. Research found roughly 26% of published agent skills carry at least one vulnerability, and injections can hide in invisible text, image pixels, or PDF metadata. It's the same verify-before-trust discipline SkillzBench is building into its free skills directory: every skill version-pinned, license-checked, and security-scanned before an agent ever sees it.

The tension here is real. Gartner recommended CISOs block AI browsers in December 2025, yet adoption continued anyway — five months later, vulnerabilities remained unresolved while corporate downloads kept climbing. The workable resolution, as one security leader put it, is to "block them today, and it's probably recommended, but have a plan for when it isn't an option anymore" and start building 2026 roadmaps now. In short: block or restrict today, but plan for managed adoption tomorrow.

Finally, hold vendors to a higher standard. Anthropic earned credibility by publishing a 1% attack success rate for Claude for Chrome against an adaptive attacker — while explicitly noting this "still represents meaningful risk." That's the transparency buyers should demand: concrete robustness numbers, human red teams (which researchers found consistently outperform automated discovery), and honest framing of residual risk. As WitnessAI puts it, "autonomous does not mean anonymous" — every agent action should tie back to a human identity. Vendors who can't show you their numbers are asking you to be their test suite.

Extend Safely: Treat Every Skill and Tool Your Agent Consumes as Untrusted Input

The same blind spot that lets a webpage hijack your browser agent also lives in the extensions you install into it. A SKILL.md file, a tool description, or an MCP connector enters your agent's context as text the model trusts implicitly — and text is exactly where the danger hides.

Menlo Security's research shows an agent can be compromised by a document that never executes code: hidden white-on-white text, tiny fonts, or PDF metadata can redirect it, because "its contents manipulate the agent into carrying out the attack." Sandboxing alone won't stop this — the file is inert; only the model's interpretation is weaponized.

The scale of the problem is measurable. Injections can hide in invisible text, HTML comments, and images that humans never see but AI vision interprets. And academic research on the WebInject technique showed that even pixel-level perturbations can steer an agent — meaning a skill or tool's documentation is a full attack surface, not just documentation.

So before anything enters your agent's context, apply the same discipline you would to untrusted web content:

• Pin the version. Lock every skill and tool to a specific commit SHA so upstream changes can't silently alter what your agent reads.
• Check the license. An ambiguous license on a skill package is a legal risk sitting inside your workflow.
• Security-scan before loading. Look for hidden instructions, exfiltration paths, and prompt-injection payloads in the text itself.
• Scope what each agent sees. An agent should only have access to the skills and tools you've explicitly vetted for it — nothing more.

This is precisely the verify-and-scan workflow SkillzBench is building into its free skills directory and free MCP connector. Every skill version is pinned to a commit SHA, license-checked, and security-scanned before it qualifies for listing, and per-agent loadouts mean your agent only ever sees the skills you've deliberately chosen for it — never the whole catalog.

The parallel to browser security is exact. Anthropic's own testing found that "no browser agent is immune to prompt injection", and the same holds for any agent consuming third-party text. The goal isn't to avoid extending your agents — it's to make sure every instruction package they consume has been checked before it reaches them.

If you want to load your agents with skills that have been scanned, validated, and benchmarked rather than copied blind from a repo, join the SkillzBench waitlist for early access. Skills, proven — before your agent ever reads them.