If you have come across a modern browser, you must have noticed that it has changed. It has not remained passive just to open tabs or search bars. It has become active and intelligent. Browsers such as Comet (Perplexity), Atlas (ChatGPT) or Aria (Opera) perform actions for you. Almost like a personal assistant facilitating everyday tasks.
AI browsers unlock productivity gains. They alert us towards security risks. Conventional browsers simply display content. AI browsers interpret, summarize, autofill and even execute tasks for you users. They provide autonomy layer and alert us to risks. Attackers assault this thinking layer, using advanced techniques such as prompt injection to influence browser behaviour.
OpenAI’s Atlas puts the assistant at the centre of your digital life. It has access to all authenticated sessions (SaaS, email, banking and corporate systems). In an AI browser, attackers do not need to trick the user. They instead trick the browser.
In prompt injection, they send malicious instructions on a webpage. It is barely visible or off-screen text. It overrides user’s commands. AI is unable to distinguish between what you typed and the instructions which secretly tells it to do. The assistant can be coerced to read emails, scrap calendars or move data between apps. The browser gets converted into an insider threat.
AI-powered browsers extend an LLM’s decision-making to web actions and authenticated sites. It creates new attack surfaces. Attackers can deliver malicious content through compromised web pages, deceptive emails. There are flaws in Comet (Perplexity). There could be data leakage.
There is an issue of privacy. On an agent which digests an injection, it can pivot to other tabs or SaaS. It behaves as if you are doing it. Another issue is tool misuse. An agent passes its own instructions. The third use is persistence. Attackers contaminate long-term memory. Bad introductions survive across sessions and trigger later.
Education and government are the most targeted sectors. There is silent data exfiltration from SaaS and Cloud apps.
AI browsers are candidates for high-risk attack surface. There should be strong AI governance. The risks cannot be managed simply by human oversight. There should be AI-powered defences, protecting you at machine speed!