Researchers have discovered a security flaw in AI web browsers that could result in users having their data exposed by malicious websites.
Browsers equipped with AI agents, such as ChatGPT's Atlas, are like ordinary internet browsers but with additional chatbot functionality baked into the software. Using AI, agentic browsers can summarize websites, search for specific information, and even automate repetitive tasks.
For example, somebody may use an AI browser to make a purchase — whereas they would have to browse a webstore for the item and then make the payment if they used a conventional browser.
Many agentic browsers have only been released in 2025, and they're already rising in popularity. Scientists, however, have warned in a new study that many popular AI browsers bypass an important security measure that keeps their data private. They presented their findings April 26 at the Agents in the Wild Workshop in Rio de Janeiro, Brazil.
"Browser agents aren't ready for the public," said co-author of the study David Kohlbrenner, an assistant professor of computer science and engineering at the University of Washington, in a statement.
"Even if you’re a relatively savvy user, if these agents have access to a browser that contains your credentials — your email, your bank account, whatever it is — you should not trust that these systems are ready to truly protect your information. They may get there in time, but they're not there yet."
Bypassing embedded security
Conventional internet browsers use a security protocol called the "same-origin policy," which ensures that multiple websites a user is visiting at the same time do not interact with each other. This is to stop potentially malicious online content from spilling over into other sites. For example, if a user had a bank's website open in one tab with a webpage containing malicious code in another, the same-origin policy would prevent these two sites from interacting.
However, AI browsers require full access to all the web content available to the user, which could include cross-origin iframes — code shared across multiple websites, such as online advertisements — or require cross-origin visibility so they can access information from multiple websites. An AI browser essentially has the same overview as a user.
Although internet browser security has been hardened through decades of research, the security for AI browsers remains in its infancy.
One major risk, for instance, is "prompt injection," whereby an AI agent is tricked into misinterpreting data embedded on a malicious website as an instruction they need to carry out. In their study, the researchers offered an example of an AI browser visiting an otherwise "safe" website, with malicious code embedded within that contained a hidden instruction for the agentic browser to automatically share the user's personal details.
Roesner also highlighted "memory poisoning" as a massive risk, in which AI agents store information they've processed in their memory for future use, making the content vulnerable to attack. He added in the statement: "We found that some of these agents would mingle information from different origins, likely because they were revising and compressing their memory."
The better the browser, the riskier it is
The key focus in this research was to assess how current AI browsers interact with the same-origin policy and what the security implications could be. The researchers examined seven browsers — including Atlas, Claude for Chrome, Brave Leo AI, Chrome with Gemini, Microsoft Edge with CoPilot, Firefox AI Mode and Perplexity Comet — with test sites and prompts, allowing them to study how each behaved.
They focused on the information an agent could access from same-origin and cross-origin webpages, the actions each agentic browser can undertake on the web, and the agent’s chat context and history.
There is no consistency among AI browsers in how they operate, the researchers found, which they suggest could be due to the lack of standardization in how AI browsers interact with browser security.
Several AI browsers could freely access cross-origin frame content, while others restrict access. Likewise, some agentic browsers could simultaneously access multiple tabs, but most require permission from the user. Similarly, some agents could take actions directly on a page in response to instructions on a webpage, but others are unable to take any actions at all.
Related stories- AI hallucinations work both ways, study shows — using chatbots can amplify and reinforce our own delusions
- There are 32 different ways AI can go rogue, scientists say — from hallucinating answers to a complete misalignment with humanity
- AI may accelerate scientific progress — but here's why it can't replace human scientists
The researchers recommended that users be careful in choosing which AI browser they install, as a standardized security model has not been developed. They are particularly cautious about Claude for Chrome, well-known for its strong capabilities, as well as Atlas and Comet, which have similarly strong functionality. The researchers identified Brave, as well as the agentic versions of Edge and Firefox, as having stronger security due to their limited agentic features.
According to the study, AI browsers have not yet established the right trade-offs between functionality and security. Currently, the more functional a browser is, the less secure it becomes.
"We've had some really good exchanges with folks at Google, Microsoft and Brave," Roesner said. "Companies are pushing out these browsers because they’re under competitive pressure. But how to make them safe is still an open question. After 30 years of building up this same-origin policy, this is a big step back for browser security."
Looking to the future, the researchers questioned how AI agents can be integrated into browsers in ways that provide rich functionality without undermining the browser's security and potentially exposing sensitive information.
