When the Browser Works for Someone Else

For a decade, the playbook for breaching an organization has started with a person: phish the credential, spoof the invoice, call the help desk. In 2026 there is a new employee on the org chart who reads everything, clicks fast, never gets suspicious, and is signed in to everything its owner is. It is the AI agent in the browser — and attackers have noticed that it can be socially engineered more reliably than any human.

Agentic AI — software that doesn't just answer but acts, chaining steps like browsing, form-filling, purchasing, and sending — moved into the mainstream through agentic browsers such as Perplexity's Comet and OpenAI's ChatGPT Atlas, plus agent modes bolted onto tools employees already use. The pitch is real productivity. The security problem is just as real: the agent operates inside the user's authenticated sessions, and it takes its instructions from the very web pages it is asked to read.

Social engineering, rewritten for software

The core technique is prompt injection — in its indirect form, instructions hidden in content the AI will process on the user's behalf. A language model cannot reliably tell the difference between "what my user asked" and "what this web page says," so a sentence buried in a page can become a command.

This is no longer theoretical. In March 2026, Palo Alto Networks' Unit 42 published telemetry on web-based indirect prompt injection observed in the wild, concluding it "is no longer merely theoretical but is being actively weaponized." The researchers cataloged 22 distinct payload techniques across live web pages: instructions concealed as visible plaintext a human would skim past (37.8% of cases), cloaked in HTML attributes (19.8%), or hidden with CSS so only the machine reads them (16.9%). Observed goals ranged from manipulating AI content moderators and hiring screeners to attempted data destruction (14.2% of payloads), forced purchases, and leaking sensitive data.

The most striking number is about method. Among the manipulation techniques Unit 42 observed, 85% used social engineering — fake authority claims, invented "developer modes," urgency framing — aimed at the model. Attackers are running the pretexting playbook against software, because software believes it.

"The web itself effectively becomes an LLM prompt delivery mechanism." — Unit 42, Palo Alto Networks

From lab demo to live browser

The agentic-browser cases show how short the path is from a hidden sentence to a compromised account.

When	What was shown	Source
Aug 2025	A Reddit comment hidden behind a spoiler tag hijacked Comet's summarizer into harvesting the user's email address and one-time code — enough for account takeover	Brave research
Oct 2025	ChatGPT Atlas's omnibox treated a malformed URL as a trusted prompt, letting attacker text trigger cross-domain actions in the user's sessions	NeuralTrust, via SecurityWeek
Mar 2026	Indirect injection payloads observed across live web pages — 22 techniques, from ad-review evasion to data destruction	Unit 42
Apr 2026	Gartner: 25% of enterprise GenAI applications will log five or more minor security incidents per year by 2028, up from 9% in 2025	Gartner

The Brave proof of concept deserves a close read, because every step abused trust rather than code. The hidden comment told Comet to open the user's account page and extract their email address, visit a lookalike domain to trigger a one-time password, read that password out of the user's already logged-in Gmail, and post both back into the Reddit thread. No exploit, no malware — just instructions, followed obediently, with the user's own privileges. Brave's conclusion was blunt: "The contents of the page should always be treated as untrusted."

Just as telling is what happened after disclosure. Perplexity acknowledged the report within days and shipped a fix — and Brave's retesting found the fix incomplete, twice, including after publication. That is not a criticism of one vendor; it is the nature of the flaw. There is no input filter that reliably separates "content" from "instructions" for a system whose entire job is to read content and act on it, which is why every serious analysis treats injection as a risk to be contained by architecture and process, not patched away.

And the exposure usually arrives unmanaged. Agentic browsers are consumer products employees install themselves, which makes them the newest wing of shadow AI: Netskope's 2026 research already found weekly enterprise AI usage jumping from 34% to 59% of users in a year, much of it on personal accounts invisible to IT. An unsanctioned agent with access to corporate SSO is an unmonitored employee with perfect memory and no skepticism.

The combination to refuse

Gartner's April 2026 analysis of agentic AI security draws the clearest operational line. Risk concentrates where an agent has all three of: access to sensitive data, exposure to untrusted content, and the ability to communicate externally. Gartner tells security leaders to treat that combination as a "no-go zone" — and predicts that by 2029, 15% of enterprise GenAI applications will suffer at least one major security incident per year, five times the 2025 rate.

Look back at the Comet proof of concept and you'll find exactly that triad: Gmail access (sensitive data), a Reddit page (untrusted content), and the ability to post a reply (external communication). Remove any one leg and the attack collapses. That is the design insight that turns an unsolvable model problem into a solvable architecture problem — because the industry consensus is that injection itself cannot yet be fully patched, only contained.

Six moves to make before an agent acts on your behalf

1. Find the agents you already have. Extend your shadow-AI discovery to agentic browsers and extensions with autonomous capabilities. You cannot set policy for a workforce of agents you have not inventoried.

2. Write the no-go rule into policy. No sanctioned agent workflow should combine sensitive-data access, untrusted content, and external communication. Review requested use cases against that triad explicitly, the way you review new SaaS vendors.

3. Give agents their own identity, not the user's. Where tooling allows, agents should authenticate with scoped, auditable credentials — not inherit a human's full SSO session. An agent that cannot reach the mailbox cannot be injected into forwarding it.

4. Keep a human in the loop for consequential actions. Sending, paying, sharing, deleting, and credential entry should require explicit user confirmation, every time. This is the agent-era equivalent of callback verification for wire transfers.

5. Train people for their new supervisory role. Employees need to know that an AI summary can be manipulated by the page it summarizes, that an agent asking to "verify your identity" mid-task is a red flag, and that agent misbehavior is reportable just like a phish. Fold agent scenarios into security awareness training and tabletop exercises — the attacker's lure is the same; only the mark has changed.

6. Measure it like any other human risk. Which teams run agents, with what access, and how they respond to agent-era lures belongs in your human risk score alongside simulation results, just as AI-generated phishing pushed email metrics to evolve.

The mark has changed; the defense hasn't

Every durable lesson of human risk management carries over to agents: least privilege beats blanket trust, verification beats urgency, and the systems that assume manipulation will happen outlast the ones that assume it won't. Your employees spent years learning not to believe everything they read on the internet. Their agents believe all of it, act on it in seconds, and do so with your users' keys. Govern them like the credulous new hires they are — before someone else's instructions start arriving through pages your people never even see.