Most AI browser agents can see every tab you have open, read what you type, and access the model's own system prompt — all at once. Most companies deploying these agents haven't fully reckoned with what that operating model exposes.
Prompt injection ranks #1 in the OWASP Top 10 for LLM Applications — second edition running
of enterprise AI agents go live with full security and IT approval, per Gravitee's 2026 State of AI Agent Security report
of deployed AI agents are actively monitored or secured — meaning most aren't, per the same report
The gap those numbers describe isn't a features gap. It's a governance gap — and it's sitting inside a category of attack most end users, and a fair number of the companies shipping these agents, haven't fully priced in.
It's called indirect prompt injection. An agent browsing on a user's behalf can't always tell the difference between an instruction from that user and an instruction hiding in the page it just read. Hidden text on any site — a forum thread, a support ticket, a shared doc — can carry an embedded instruction: send the saved logins, forward the session data, initiate a transfer. The text can be invisible to a human and fully readable to the model: zero-size font, white-on-white, off-screen, buried in alt-text or an HTML comment. The user never sees it. The agent does.
Guardrails here aren't one control. They're a stack of mitigations, because no single layer reliably catches indirect injection on its own — and most agents shipping right now are missing most of the stack.
- A trust boundary on page content. Rendered page content has to be treated as untrusted input, not as instructions — the same way a browser already sandboxes a page's JavaScript from the browser itself. Most agents don't yet draw that line clearly between "the user told me to do this" and "the page told me to do this."
- Action-level friction on consequential steps. Payments, credential entry, and data transfers sit behind an explicit confirmation before they execute. No agent should be able to silently act on a hidden instruction it picked up on the open web.
- Monitoring on the agent's own action stream. Logging what the agent did, why, and which page element or instruction triggered it is what makes a compromised session auditable after the fact — and what turns a one-off incident into a pattern that gets blocked instead of repeated.
- Scoped access, not standing access. Most agents inherit a user's full session — every account, every cookie, every open tab. That's the blast-radius problem. An agent doing one task should only have access to what that task needs.
- Pre-filtering before the model reads it. Zero-size fonts, off-screen positioning, background-matched text — these are rarely legitimate and should be flagged or stripped before the agent processes them at all.
None of this replaces testing before launch, not after. Injection attacks follow known patterns by now — hidden text, alt-text, ARIA labels, unicode tricks. Any organization shipping a browser agent, or evaluating a vendor's, should be running it against that playbook before release, not treating production traffic as the QA process.
The difference is that SQL injection never had access to a bank login, a set of health records, and a crypto wallet all in the same session. The guardrails available today mostly limit what a hijacked agent can do — they don't yet guarantee it can't be hijacked in the first place. That's a meaningful improvement over nothing. It's also a narrower guarantee than "fully autonomous" marketing tends to imply.
That's the governance gap this piece opened with, and it doesn't close on its own. Trust boundaries, confirmation steps, scoped access, monitoring, and pre-launch testing against known attack patterns are unglamorous engineering decisions — but they're the difference between shipping a tool and shipping a liability. Before deploying an AI browser agent, or approving a vendor's, the question worth asking is simple: what can it access, what needs confirmation, and what happens when it reads something it shouldn't trust? If that answer isn't immediate and specific, the guardrails aren't there yet.
The guardrail stack is the work. We help growth-stage companies build it before an agent ships, not after an incident.