Browser AI agent security against indirect prompt injection

Browser AI agents combine untrusted internet content with an active session that can click, type and download. Hidden page instructions can redirect an agent’s plan without exploiting the browser itself.

Separate browser profiles

Do not use a daily profile containing email, banking and cloud consoles. Create an ephemeral profile without history or unnecessary cookies. Authenticate only to the domain and task in scope.

Navigation policy

Allowlist the target domain and controlled dependencies. Validate final origin after redirects. Block file:, local addresses, metadata services, executable downloads and unknown extensions.

Form entry is high risk. Separate value generation from recipient approval. A browser component inserts passwords and tokens, not the model.

Approval-bound actions

Purchases, messages, publishing, uploads, OAuth consent, permission changes and deletion require parameter-bound confirmation. A page screenshot is not authorisation.

Injection tests

Place instructions in text, alt attributes, CSS, comments, PDFs, advertisements and search results. Verify that the original goal remains and data is not sent to a new origin.

OWASP lists web pages, documents and email as indirect prompt-injection sources. Apply prompt-injection controls while enforcing decisions deterministically in the browser layer.

Threat model for a browser session

An agent sees the user’s instruction and untrusted page content at the same time. The risk appears when the model interprets website text as a higher-priority command. Malicious instructions may be visible, hidden in an attribute, embedded in a document or delivered through a search result. Keyword filtering cannot solve this because the same intent can be expressed in many forms.

The critical control sits outside the model. The execution layer knows the original goal, permitted origins, data classes and maximum impact. Navigation, reading and clicking carry different risk from form submission, purchasing, password changes or downloads. Every state-changing action is revalidated regardless of the LLM’s explanation.

Sessions, data and human confirmation

Use a separate profile with no private history, saved passwords or unrelated authenticated sessions. Restrict clipboard, downloads, uploads, custom protocols, localhost and private-address access. A new origin does not inherit consent granted to a previous domain.

The confirmation screen must show the concrete effect: domain, recipient, data fields and operation. A generic “continue?” prompt does not give the user enough information. Consent must be refreshed after page changes or a long delay.

Test scenarios

Build pages with visible and hidden instructions, redirects, fake sign-in dialogs, links to private addresses, data-submission forms and documents containing prompts. Measure not only final exfiltration but attempts to change the goal, access new origins, invoke high-impact actions and bypass controls.

Repeat the suite after changing the model, system prompt, browser or tool set. Safe behaviour from one model is not a permanent property of the architecture.

Download and upload controls

Treat every download as quarantined. Validate declared and actual type, size, name, active content, traversal and decompression risk. The agent must not automatically open a file in an application that can access private data.

Uploads require an explicit source and recipient. Policy should display the exact files and fields leaving the environment, while blocking hidden attachments, paths outside the workspace and another tenant’s data. Page text cannot expand the selected set.

Security signals

Record origin changes, localhost or private-IP attempts, sensitive reads, form fills, downloads, uploads and approval-gated actions. Events include executor decisions and request source without requiring full page content.

Alert on sequences rather than isolated clicks. An external document, new origin, secret-read attempt and outbound form together are stronger than any one action. This telemetry helps distinguish model error from indirect injection and supports rapid session revocation.

---

Isolating page content from user intent

Page text, accessibility attributes, comments, documents and search results are untrusted. The agent must not treat them as higher-priority instructions. Tool policy operates outside the model and binds allowed domains, operation types and data to user-confirmed intent.

Before form submission, show recipient, fields and effects; credentials must not reach an arbitrary domain named by page content. Test hidden prompts, redirects, iframes, downloads and content changes between planning and clicking. A screenshot is insufficient: log policy decisions, target origin and tool calls.

Sources: OWASP Prompt Injection Prevention, OWASP AI Agent Security.