Every AI Browser Tested Was Vulnerable To Prompt Injection, And There Is No Clean Fix

White text on a white background. That is the attack that worked on every major AI browser researchers put it to this year.

Opera's AI browser, Perplexity Comet and ChatGPT Atlas all executed instructions hidden inside web pages. The hiding places are unglamorous: text coloured to match the background, HTML comments, anything the model reads on your behalf and your eyes never land on. The technique is called indirect prompt injection, and it is the same failure in all three products.

Why an agent is a bigger target than a chatbot

A chatbot that reads a poisoned page says something wrong. An agentic browser acts on it.

The difference is the session. The agent runs inside the browser you are already logged into, so it inherits every cookie and every authenticated tab you have open. Researchers made Comet fetch one-time passcodes out of email and touch banking portals, not because it defeated authentication but because it never had to. It was already you.

Palo Alto Unit 42 has telemetry showing indirect injection used against real deployments rather than only in test harnesses. Microsoft's security team has documented prompt-driven remote code execution in agent frameworks, where injected text reaches a shell instead of just a reply.

The unusual part is who said it out loud

In May the Five Eyes agencies, meaning CISA and the NSA plus the UK, Canadian, Australian and New Zealand equivalents, published joint guidance on agentic AI. It names prompt injection as the core manipulation route and says plainly that no single safeguard is enough.

Joint advisories are normally drafted to avoid exactly that sentence. The research position matches it: comprehensive defence is unsolved, and the realistic plan is layered guardrails that reduce risk instead of removing it.

This is the security story trailing every agent product shipped this year, including Meta's Hatch. It is also why the plumbing arguments matter, because the permission model in A2A versus MCP is where any real fix would have to live.

What to actually do

Nobody is patching this away, so the useful move is limiting blast radius.

Run the agentic browser in a separate profile from the one holding your email and your bank. Do not point an agent at untrusted pages from the browser carrying your logged-in sessions. Turn off the agent's ability to act rather than read when you are browsing anywhere you did not choose deliberately. Treat any page the agent summarised as untrusted input, because that is what it is.

Session hygiene is the part that generalises. If an agent can read your inbox then it can read a code sent to your inbox, which is why a phishing-resistant hardware key is worth more than SMS or an authenticator app. A YubiKey 5 NFC does not care what an agent read, because the secret never travels through the page at all. Check current pricing on Amazon → if you have been meaning to move off codes. The same logic runs through most of our Android security checklist.

Shipping is not waiting for the fix. The products are out, the injection works, and the official guidance is that layered defence is the ceiling. Assume the browser gets talked into something eventually, and decide now what it should not have access to when that happens.

Disclosure: some links above are Amazon Associates links. If you buy through them Future Technology earns a small commission at no extra cost to you.