Agentic Browser Security: 2025 Year-End Review

Are agentic browsers the new Flash? A 2025 review of new attacks, vendor security layers, and a roadmap for navigating AI browser risks.

An Agentic Browser is an AI-powered co-pilot that not only reads the web, it acts on it. By understanding page content and executing multi-step tasks autonomously, these agents can book flights, shop, and fill out forms without step-by-step human guidance. In 2025, this technology moved rapidly from experimental prototype to mainstream production.

But that autonomy brings major risks along. As werecently observed in TechCrunch:

The risk is high given [Agentic Browsers'] access to sensitive data like email and payment information, even though that access is also what makes them powerful. That balance will evolve, but today the trade-offs are still very real.

We’ve spent the last year tracking this space. Here is how we reached that conclusion, the offensive and defensive research we’ve been monitoring, and how the "autonomy vs. access" matrix will shape the future of browsing.

Generative AI has been integrated into browsers since the early days of LLMs. The Brave browser launched abrowser-integrated AI assistant in 2023, shortly after the launch of ChatGPT. However, 2025 was the year AI Browsers went mainstream:

These launches have come withimpressive demo videosand bold promises of a future where you never have to "manually" browse again.

The rapid growth of agentic browsers has been met with a concurrent surge in security research:

February:Shortly following the ChatGPT Operator preview, Johann Rehberger demonstratedZero-Interaction Exfiltration, using hidden instructions on a GitHub page to command the AI to leak private data without user input.

August:Guardio Labs published “Scamlexity,” revealing that AI browsers lack the "skepticism" needed to spot phishing. In tests, Perplexity’s Comet successfully purchased items from fake storefronts and clicked phishing links on behalf of the user.

August-October:Brave turned their research on to competing AI Browsers, disclosingIndirect Prompt Injection in Perplexity Comet,prompt injections in screenshotsimpacting Comet & Fellou, andprompt injection in Opera Neon.

September:Tenable disclosed the “Gemini Trifecta,” proving that browsers could be tricked into leaking sensitive data via background API calls.

October:LayerX demonstrated a "one-click" hijack of Perplexity’s Comet ("CometJacking") using crafted URL query parameters to exfiltrate emails and calendar data. They also disclosed "Tainted Memories," a CSRF vulnerability in OpenAI’s Atlas that allowed attackers to "poison" the long-term memory of the AI, creating persistent malicious instructions that survived across sessions.

November:Cato Networks published “HashJack,” an indirect prompt injection technique that hides instructions in URL fragments (after the #).

December:A Google researcher disclosed “Task Injection” in OpenAI's Operator. This tricks the agent into believing a malicious sub-task (like solving a fake CAPTCHA that actually triggers a file download) is a legitimate part of achieving the user's original goal.

The developers of these Agentic Browsers have not been passive. They have moved from simple "Ask before acting" prompt-based security to multi-layered security architectures. We are seeing a convergence aroundHuman-in-the-Loop (HITL)as the guardrail, while the real technical differentiation now lies inReinforcement Learning,Architectural IsolationandSecondary LLM Critics.

The table below outlines the defensive posture documented as of the end of 2025:

To make sense of this table, it helps to think of the security model as a series of filters. No single layer is a "silver bullet" against prompt injection, but together they raise the cost of an attack significantly.

Ideally, we will see these vendors continue to learn from each other, and constantly pushing forward the state of the art.

We get a clear and consistent message from the front lines. OpenAI’s CISO, Dane Stuckey, identified recently thatprompt injection remains a frontier, unsolved security problem.While manufacturers are racing to build layered controls, the technical reality is that as long as an agent is working against untrusted web content, it can be manipulated.

When reasoning about these risks, the quick framework is theAutonomy and Access Matrix. Agentic browsers occupy the most dangerous quadrant: they possess the autonomy to act and high-level access to the sensitive data stored in your browser.

We are likely reliving a familiar cycle in browser security history. But is it the"Flash" era, where the technology is so structurally porous that it will eventually be abandoned? Or theearly browser era, simply enduring the "growing pains" of bugs that will eventually be solved by the multi-layered sandboxing we see vendors currently prototyping?

In December 2025, Gartner issued a definitive directive recommending that CISOsblock the use of AI browsersfor now. While this aligns with a "security-first" posture, it risks creating a "Department of No" culture that stifles innovation. Kane Narraway, a security leader,offered a more nuanced take:

You can totally block them today, and it’s probably recommended, but have a plan for when it isn’t an option anymore, and start building this into your roadmaps for 2026.

We cannot reach frontier capabilities without these risks. The goal is not to avoid the technology forever, but to celebrate the current transparency around its flaws while making responsible decisions.

If you are experimenting with Agentic Browsers today, follow these three rules:

Isolate the Context:Use dedicated, isolated browser profiles that do not share credentials with your primary work email or banking.

Preserve the Human:Never disable "Human-in-the-Loop" confirmations when working with a privileged agentic browser session.

Limit the Blast Radius:Restrict agent use to low-stakes tasks (e.g., research, public data gathering) where a "hallucinated" or "injected" action carries lower cost.

Get full-stack visibility into your AI pipelines to uncover misconfigurations and attack paths that actually matter.

Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories - including the JavaScript SDK powering the AWS Console.

Whether you’re new to Wiz or early in your cloud security journey, start the year strong by turning cloud security resolutions into real impact in your first 90 days with Wiz.

Building the future of cloud security, together.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings